WSL2-Linux-Kernel/include/sound
Takashi Iwai 7777744e92 ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
commit bc55cfd571 upstream.

syzbot caught a potential deadlock between the PCM
runtime->buffer_mutex and the mm->mmap_lock.  It was brought by the
recent fix to cover the racy read/write and other ioctls, and in that
commit, I overlooked a (hopefully only) corner case that may take the
revert lock, namely, the OSS mmap.  The OSS mmap operation
exceptionally allows to re-configure the parameters inside the OSS
mmap syscall, where mm->mmap_mutex is already held.  Meanwhile, the
copy_from/to_user calls at read/write operations also take the
mm->mmap_lock internally, hence it may lead to a AB/BA deadlock.

A similar problem was already seen in the past and we fixed it with a
refcount (in commit b248371628).  The former fix covered only the
call paths with OSS read/write and OSS ioctls, while we need to cover
the concurrent access via both ALSA and OSS APIs now.

This patch addresses the problem above by replacing the buffer_mutex
lock in the read/write operations with a refcount similar as we've
used for OSS.  The new field, runtime->buffer_accessing, keeps the
number of concurrent read/write operations.  Unlike the former
buffer_mutex protection, this protects only around the
copy_from/to_user() calls; the other codes are basically protected by
the PCM stream lock.  The refcount can be a negative, meaning blocked
by the ioctls.  If a negative value is seen, the read/write aborts
with -EBUSY.  In the ioctl side, OTOH, they check this refcount, too,
and set to a negative value for blocking unless it's already being
accessed.

Reported-by: syzbot+6e5c88838328e99c7e1c@syzkaller.appspotmail.com
Fixes: dca947d4d2 ("ALSA: pcm: Fix races among concurrent read/write and buffer changes")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/000000000000381a0d05db622a81@google.com
Link: https://lore.kernel.org/r/20220330120903.4738-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-08 14:22:55 +02:00
..
ac97
sof ASoC: SOF: ext_manifest: use explicit number for elem_type 2021-02-10 17:17:13 +00:00
ac97_codec.h
aci.h
ad1816a.h
ad1843.h
adau1373.h
ak4xxx-adda.h
ak4113.h
ak4114.h
ak4117.h
ak4531_codec.h
ak4641.h
alc5623.h
asequencer.h
asound.h
asoundef.h
compress_driver.h ALSA: compress: Drop unused functions 2021-07-15 10:22:30 +02:00
control.h ALSA: control - add generic LED trigger module as the new control layer 2021-03-30 15:33:58 +02:00
core.h ALSA: core: Add device-managed request_dma() 2021-07-19 16:16:34 +02:00
cs35l33.h
cs35l34.h
cs35l35.h
cs35l36.h
cs42l52.h
cs42l56.h
cs42l73.h
cs4231-regs.h
cs4271.h
cs8403.h
cs8427.h
da7213.h
da7218.h
da7219-aad.h
da7219.h
da9055.h
designware_i2s.h
dmaengine_pcm.h ASoC: dmaengine_pcm: add peripheral configuration 2021-02-05 17:16:41 +00:00
emu10k1.h ALSA: emu10k1: Allocate resources with device-managed APIs 2021-07-19 16:16:56 +02:00
emu10k1_synth.h
emu8000.h ALSA: sb: Allocate resources with device-managed APIs 2021-07-19 16:17:14 +02:00
emu8000_reg.h
emux_legacy.h
emux_synth.h
es1688.h ALSA: es1688: Avoid devres management for es1688 object creation 2021-08-05 08:24:17 +02:00
graph_card.h ASoC: audio-graph: move audio_graph_remove() to simple-card-utils.c 2021-04-20 17:25:45 +01:00
gus.h
hda_chmap.h
hda_codec.h ALSA: hda: Fix potential deadlock at codec unbinding 2022-01-27 11:04:05 +01:00
hda_component.h
hda_hwdep.h
hda_i915.h
hda_register.h ALSA: hda: Change AZX_MAX_BUF_SIZE from 1GB to 4MB 2021-03-19 16:54:58 +01:00
hda_regmap.h
hda_verbs.h
hdaudio.h ALSA: hda: add link_power op to hdac_bus_ops 2021-02-08 15:56:35 +01:00
hdaudio_ext.h ALSA: hda: hdac_ext_stream: fix potential locking issues 2021-11-25 09:49:08 +01:00
hdmi-codec.h ASoC: hdmi-codec: Add a prepare hook 2021-06-10 11:48:56 +02:00
hwdep.h
i2c.h
info.h
initval.h
intel-dsp-config.h ALSA: hda: intel-dsp-config: add helper for ACPI DSP driver selection 2020-11-19 18:24:35 +00:00
intel-nhlt.h ALSA: hda: intel-nhlt: verify config type 2021-03-02 10:22:47 +01:00
jack.h ALSA: jack: implement software jack injection via debugfs 2021-02-02 10:37:07 +01:00
l3.h
madera-pdata.h
max9768.h
max98088.h
max98090.h
max98095.h
memalloc.h ALSA: memalloc: Correctly name as WC 2021-08-04 08:07:58 +02:00
minors.h
mixer_oss.h
mpu401.h
omap-hdmi-audio.h
opl3.h
opl4.h
pcm-indirect.h
pcm.h ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock 2022-04-08 14:22:55 +02:00
pcm_drm_eld.h
pcm_iec958.h ALSA: iec958: Split status creation and fill 2021-06-08 17:05:41 +02:00
pcm_oss.h
pcm_params.h
pt2258.h
pxa2xx-lib.h ALSA: pxa2xx: Use managed PCM buffer allocation 2021-08-04 08:08:21 +02:00
rawmidi.h ALSA: rawmidi: introduce SNDRV_RAWMIDI_IOCTL_USER_PVERSION 2021-09-23 09:26:40 +02:00
rt286.h
rt298.h
rt1015.h
rt5514.h
rt5659.h
rt5660.h
rt5663.h
rt5665.h
rt5668.h
rt5682.h ASoC: rt5682: Add a new property for the DMIC clock driving 2020-11-13 14:22:09 +00:00
s3c24xx_uda134x.h
sb.h
sb16_csp.h
seq_device.h
seq_kernel.h
seq_midi_emul.h
seq_midi_event.h
seq_oss.h
seq_oss_legacy.h
seq_virmidi.h
sh_dac_audio.h
sh_fsi.h
simple_card.h
simple_card_utils.h ASoC: audio-graph: move audio_graph_remove() to simple-card-utils.c 2021-04-20 17:25:45 +01:00
snd_wavefront.h
soc-acpi-intel-match.h ASoC: Intel: common: add ACPI matching tables for Alder Lake 2020-12-09 16:52:04 +00:00
soc-acpi.h ASoC: soc-acpi: add new fields for mach_params 2021-04-12 17:05:51 +01:00
soc-card.h
soc-component.h ASoC: soc-utils: add snd_soc_component_is_dummy() 2021-04-16 14:34:12 +01:00
soc-dai.h ASoC: soc-core: add snd_soc_runtime_get_dai_fmt() 2021-06-07 15:55:12 +01:00
soc-dapm.h
soc-dpcm.h ASoC: Revert PCM trigger changes 2021-08-30 12:15:15 +01:00
soc-jack.h ASoC: add soc-jack.h 2020-11-30 12:54:02 +00:00
soc-link.h ASoC: soc-pcm: care trigger rollback 2020-12-09 12:13:38 +00:00
soc-topology.h ASoC: topology: Fix stub for snd_soc_tplg_component_remove() 2021-11-18 19:16:55 +01:00
soc.h ASoC: soc-pcm: add a flag to reverse the stop sequence 2021-07-16 13:54:58 +01:00
sof.h ASoC: SOF: add a helper to get topology configured bclk 2021-07-11 23:48:30 +01:00
soundfont.h
spear_dma.h
spear_spdif.h
sta32x.h
sta350.h
tas2552-plat.h
tas5086.h
tea6330t.h
timer.h
tlv.h
tlv320aic3x.h
tlv320aic32x4.h
tlv320dac33-plat.h
tpa6130a2-plat.h
uda134x.h
uda1380.h
util_mem.h
vx_core.h
wavefront.h
wm0010.h
wm1250-ev1.h
wm2000.h
wm2200.h
wm5100.h
wm8903.h
wm8904.h
wm8955.h
wm8960.h
wm8962.h
wm8993.h
wm8996.h
wm9081.h
wm9090.h
wss.h