WSL2-Linux-Kernel/include/sound
Takashi Iwai 7777744e92 ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
commit bc55cfd571 upstream.

syzbot caught a potential deadlock between the PCM
runtime->buffer_mutex and the mm->mmap_lock.  It was brought by the
recent fix to cover the racy read/write and other ioctls, and in that
commit, I overlooked a (hopefully only) corner case that may take the
revert lock, namely, the OSS mmap.  The OSS mmap operation
exceptionally allows to re-configure the parameters inside the OSS
mmap syscall, where mm->mmap_mutex is already held.  Meanwhile, the
copy_from/to_user calls at read/write operations also take the
mm->mmap_lock internally, hence it may lead to a AB/BA deadlock.

A similar problem was already seen in the past and we fixed it with a
refcount (in commit b248371628).  The former fix covered only the
call paths with OSS read/write and OSS ioctls, while we need to cover
the concurrent access via both ALSA and OSS APIs now.

This patch addresses the problem above by replacing the buffer_mutex
lock in the read/write operations with a refcount similar as we've
used for OSS.  The new field, runtime->buffer_accessing, keeps the
number of concurrent read/write operations.  Unlike the former
buffer_mutex protection, this protects only around the
copy_from/to_user() calls; the other codes are basically protected by
the PCM stream lock.  The refcount can be a negative, meaning blocked
by the ioctls.  If a negative value is seen, the read/write aborts
with -EBUSY.  In the ioctl side, OTOH, they check this refcount, too,
and set to a negative value for blocking unless it's already being
accessed.

Reported-by: syzbot+6e5c88838328e99c7e1c@syzkaller.appspotmail.com
Fixes: dca947d4d2 ("ALSA: pcm: Fix races among concurrent read/write and buffer changes")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/000000000000381a0d05db622a81@google.com
Link: https://lore.kernel.org/r/20220330120903.4738-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-08 14:22:55 +02:00
..
ac97
sof ASoC: SOF: ext_manifest: use explicit number for elem_type 2021-02-10 17:17:13 +00:00
ac97_codec.h ALSA: ac97: Treat snd_ac97_bus_ops as const 2020-01-03 09:24:08 +01:00
aci.h
ad1816a.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
ad1843.h
adau1373.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149 2019-05-30 11:25:18 -07:00
ak4xxx-adda.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
ak4113.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
ak4114.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
ak4117.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
ak4531_codec.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
ak4641.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
alc5623.h
asequencer.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
asound.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
asoundef.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
compress_driver.h ALSA: compress: Drop unused functions 2021-07-15 10:22:30 +02:00
control.h ALSA: control - add generic LED trigger module as the new control layer 2021-03-30 15:33:58 +02:00
core.h ALSA: core: Add device-managed request_dma() 2021-07-19 16:16:34 +02:00
cs35l33.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
cs35l34.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
cs35l35.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
cs35l36.h
cs42l52.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
cs42l56.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
cs42l73.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
cs4231-regs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
cs4271.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
cs8403.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
cs8427.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
da7213.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
da7218.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
da7219-aad.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
da7219.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
da9055.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
designware_i2s.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
dmaengine_pcm.h ASoC: dmaengine_pcm: add peripheral configuration 2021-02-05 17:16:41 +00:00
emu10k1.h ALSA: emu10k1: Allocate resources with device-managed APIs 2021-07-19 16:16:56 +02:00
emu10k1_synth.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
emu8000.h ALSA: sb: Allocate resources with device-managed APIs 2021-07-19 16:17:14 +02:00
emu8000_reg.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
emux_legacy.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
emux_synth.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
es1688.h ALSA: es1688: Avoid devres management for es1688 object creation 2021-08-05 08:24:17 +02:00
graph_card.h ASoC: audio-graph: move audio_graph_remove() to simple-card-utils.c 2021-04-20 17:25:45 +01:00
gus.h ALSA: isa/gus: remove -Wmissing-prototypes warnings 2020-07-07 11:59:59 +02:00
hda_chmap.h
hda_codec.h ALSA: hda: Fix potential deadlock at codec unbinding 2022-01-27 11:04:05 +01:00
hda_component.h
hda_hwdep.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 32 2019-05-24 17:27:10 +02:00
hda_i915.h
hda_register.h ALSA: hda: Change AZX_MAX_BUF_SIZE from 1GB to 4MB 2021-03-19 16:54:58 +01:00
hda_regmap.h ALSA: hda: Manage concurrent reg access more properly 2020-01-13 13:40:41 +01:00
hda_verbs.h
hdaudio.h ALSA: hda: add link_power op to hdac_bus_ops 2021-02-08 15:56:35 +01:00
hdaudio_ext.h ALSA: hda: hdac_ext_stream: fix potential locking issues 2021-11-25 09:49:08 +01:00
hdmi-codec.h ASoC: hdmi-codec: Add a prepare hook 2021-06-10 11:48:56 +02:00
hwdep.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
i2c.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
info.h ALSA: info: Make snd_info_entry_ops as const 2020-01-03 09:24:18 +01:00
initval.h ALSA: Allow const arrays for legacy resource management helpers 2020-01-05 16:14:26 +01:00
intel-dsp-config.h ALSA: hda: intel-dsp-config: add helper for ACPI DSP driver selection 2020-11-19 18:24:35 +00:00
intel-nhlt.h ALSA: hda: intel-nhlt: verify config type 2021-03-02 10:22:47 +01:00
jack.h ALSA: jack: implement software jack injection via debugfs 2021-02-02 10:37:07 +01:00
l3.h
madera-pdata.h ASoC: madera: Update SPDX headers 2019-06-26 12:27:50 +01:00
max9768.h
max98088.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
max98090.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
max98095.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
memalloc.h ALSA: memalloc: Correctly name as WC 2021-08-04 08:07:58 +02:00
minors.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
mixer_oss.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
mpu401.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
omap-hdmi-audio.h ALSA: Replace HTTP links with HTTPS ones 2020-07-19 20:49:25 +02:00
opl3.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
opl4.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
pcm-indirect.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
pcm.h ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock 2022-04-08 14:22:55 +02:00
pcm_drm_eld.h
pcm_iec958.h ALSA: iec958: Split status creation and fill 2021-06-08 17:05:41 +02:00
pcm_oss.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
pcm_params.h ALSA: pcm: Remove unused inline function snd_mask_sizeof 2020-09-09 18:43:07 +02:00
pt2258.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
pxa2xx-lib.h ALSA: pxa2xx: Use managed PCM buffer allocation 2021-08-04 08:08:21 +02:00
rawmidi.h ALSA: rawmidi: introduce SNDRV_RAWMIDI_IOCTL_USER_PVERSION 2021-09-23 09:26:40 +02:00
rt286.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rt298.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rt1015.h ASoC: rt1015: add delay to fix pop noise from speaker 2020-11-05 17:25:17 +00:00
rt5514.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rt5659.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rt5660.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rt5663.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rt5665.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rt5668.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rt5682.h ASoC: rt5682: Add a new property for the DMIC clock driving 2020-11-13 14:22:09 +00:00
s3c24xx_uda134x.h
sb.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
sb16_csp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
seq_device.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
seq_kernel.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
seq_midi_emul.h ALSA: seq: Constify struct snd_midi_op 2020-01-03 09:24:19 +01:00
seq_midi_event.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
seq_oss.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
seq_oss_legacy.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
seq_virmidi.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
sh_dac_audio.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
sh_fsi.h
simple_card.h
simple_card_utils.h ASoC: audio-graph: move audio_graph_remove() to simple-card-utils.c 2021-04-20 17:25:45 +01:00
snd_wavefront.h
soc-acpi-intel-match.h ASoC: Intel: common: add ACPI matching tables for Alder Lake 2020-12-09 16:52:04 +00:00
soc-acpi.h ASoC: soc-acpi: add new fields for mach_params 2021-04-12 17:05:51 +01:00
soc-card.h ASoC: soc-card: add snd_soc_card_remove_dai_link() 2020-05-30 02:11:42 +01:00
soc-component.h ASoC: soc-utils: add snd_soc_component_is_dummy() 2021-04-16 14:34:12 +01:00
soc-dai.h ASoC: soc-core: add snd_soc_runtime_get_dai_fmt() 2021-06-07 15:55:12 +01:00
soc-dapm.h ASoC: dapm: declare missing structure prototypes 2020-06-25 19:21:01 +01:00
soc-dpcm.h ASoC: Revert PCM trigger changes 2021-08-30 12:15:15 +01:00
soc-jack.h ASoC: add soc-jack.h 2020-11-30 12:54:02 +00:00
soc-link.h ASoC: soc-pcm: care trigger rollback 2020-12-09 12:13:38 +00:00
soc-topology.h ASoC: topology: Fix stub for snd_soc_tplg_component_remove() 2021-11-18 19:16:55 +01:00
soc.h ASoC: soc-pcm: add a flag to reverse the stop sequence 2021-07-16 13:54:58 +01:00
sof.h ASoC: SOF: add a helper to get topology configured bclk 2021-07-11 23:48:30 +01:00
soundfont.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
spear_dma.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
spear_spdif.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
sta32x.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
sta350.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
tas2552-plat.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
tas5086.h
tea6330t.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
timer.h ALSA: timer: Replace tasklet with work 2020-09-09 18:32:52 +02:00
tlv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
tlv320aic3x.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
tlv320aic32x4.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
tlv320dac33-plat.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
tpa6130a2-plat.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336 2019-06-05 17:37:07 +02:00
uda134x.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
uda1380.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
util_mem.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
vx_core.h ALSA: vx: Constify snd_vx_hardware and snd_vx_ops definitions 2020-01-03 09:24:20 +01:00
wavefront.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
wm0010.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
wm1250-ev1.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wm2000.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wm2200.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wm5100.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wm8903.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wm8904.h ASoC: Spelling s/configr/configur/ 2019-10-25 11:06:57 +01:00
wm8955.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
wm8960.h ASoC: wm8960: Support headphone jack detection function 2020-06-15 20:58:33 +01:00
wm8962.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wm8993.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wm8996.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wm9081.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wm9090.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wss.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00