Eric Lee / smarc-fsl-linux-kernel

12 Sep, 2017

2 commits

  • fc27fe7e8   ALSA: seq: Cancel pending autoload work at unbinding device ... Browse Code »

    ALSA sequencer core has a mechanism to load the enumerated devices
    automatically, and it's performed in an off-load work. This seems
    causing some race when a sequencer is removed while the pending
    autoload work is running. As syzkaller spotted, it may lead to some
    use-after-free:
    BUG: KASAN: use-after-free in snd_rawmidi_dev_seq_free+0x69/0x70
    sound/core/rawmidi.c:1617
    Write of size 8 at addr ffff88006c611d90 by task kworker/2:1/567

    CPU: 2 PID: 567 Comm: kworker/2:1 Not tainted 4.13.0+ #29
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
    Workqueue: events autoload_drivers
    Call Trace:
    __dump_stack lib/dump_stack.c:16 [inline]
    dump_stack+0x192/0x22c lib/dump_stack.c:52
    print_address_description+0x78/0x280 mm/kasan/report.c:252
    kasan_report_error mm/kasan/report.c:351 [inline]
    kasan_report+0x230/0x340 mm/kasan/report.c:409
    __asan_report_store8_noabort+0x1c/0x20 mm/kasan/report.c:435
    snd_rawmidi_dev_seq_free+0x69/0x70 sound/core/rawmidi.c:1617
    snd_seq_dev_release+0x4f/0x70 sound/core/seq_device.c:192
    device_release+0x13f/0x210 drivers/base/core.c:814
    kobject_cleanup lib/kobject.c:648 [inline]
    kobject_release lib/kobject.c:677 [inline]
    kref_put include/linux/kref.h:70 [inline]
    kobject_put+0x145/0x240 lib/kobject.c:694
    put_device+0x25/0x30 drivers/base/core.c:1799
    klist_devices_put+0x36/0x40 drivers/base/bus.c:827
    klist_next+0x264/0x4a0 lib/klist.c:403
    next_device drivers/base/bus.c:270 [inline]
    bus_for_each_dev+0x17e/0x210 drivers/base/bus.c:312
    autoload_drivers+0x3b/0x50 sound/core/seq_device.c:117
    process_one_work+0x9fb/0x1570 kernel/workqueue.c:2097
    worker_thread+0x1e4/0x1350 kernel/workqueue.c:2231
    kthread+0x324/0x3f0 kernel/kthread.c:231
    ret_from_fork+0x25/0x30 arch/x86/entry/entry_64.S:425

    The fix is simply to assure canceling the autoload work at removing
    the device.

    Reported-by: Andrey Konovalov
    Tested-by: Andrey Konovalov
    Cc:
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     
  • f16e666b9   ALSA: firewire: Use common error handling code in snd_motu_stream_start_duplex() ... Browse Code »

    Add a jump target so that a bit of exception handling can be better reused
    at the end of this function.

    This issue was detected by using the Coccinelle software.

    Signed-off-by: Markus Elfring
    Signed-off-by: Takashi Iwai

    Markus Elfring
     

07 Sep, 2017

10 commits

05 Sep, 2017

1 commit

04 Sep, 2017

10 commits

03 Sep, 2017

1 commit

  • 1f7f51a63   ALSA: hda: Fix regression of hdmi eld control created based on invalid pcm ... Browse Code »

    Commit fb087eaaef72 ("ALSA: hda - hdmi eld control created based on pcm")
    forget to filter out invalid pcm numbers, if there is only one invalid pcm
    number, then this issue causes we create eld control for invalid pcm silently,
    but when there are more than one invalid pcm numbers, then this issue bring
    probe error looks like below dmesg:
    "
    kernel: [ 1.647283] snd_hda_intel 0000:00:03.0: bound 0000:00:02.0 (ops 0xc2967540)
    kernel: [ 1.651192] snd_hda_intel 0000:00:03.0: Too many HDMI devices
    kernel: [ 1.651195] snd_hda_intel 0000:00:03.0: Consider building the kernel with CONFIG_SND_DYNAMIC_MINORS=y
    kernel: [ 1.651197] snd_hda_intel 0000:00:03.0: Too many HDMI devices
    kernel: [ 1.651199] snd_hda_intel 0000:00:03.0: Consider building the kernel with CONFIG_SND_DYNAMIC_MINORS=y
    kernel: [ 1.651201] snd_hda_intel 0000:00:03.0: Too many HDMI devices
    kernel: [ 1.651203] snd_hda_intel 0000:00:03.0: Consider building the kernel with CONFIG_SND_DYNAMIC_MINORS=y
    kernel: [ 1.651676] snd_hda_intel 0000:00:03.0: control 3:0:0:ELD:0 is already present
    kernel: [ 1.651787] snd_hda_codec_hdmi: probe of hdaudioC0D0 failed with error -16
    "

    This patch add invalid pcm number filter before calling hdmi_create_eld_ctl.

    Fixes: fb087eaaef72 ("ALSA: hda - hdmi eld control created based on pcm")
    Signed-off-by: Wang YanQing
    Signed-off-by: Takashi Iwai

    Wang YanQing
     

01 Sep, 2017

16 commits