wireguard-linux/sound/core/oss, branch jd/unified-crypt-queue

ALSA: pcm: oss: Fix regression by buffer overflow fix (again)

2020-04-03T07:38:50Z

[ This is essentially the same fix as commit ae769d355664, but it's adapted to the latest code for 5.7; hence it contains no Fixes or other tags for avoid backport confusion -- tiwai ] The recent fix for the OOB access in PCM OSS plugins (commit f2ecf903ef06: "ALSA: pcm: oss: Avoid plugin buffer overflow") caused a regression on OSS applications. The patch introduced the size check in client and slave size calculations to limit to each plugin's buffer size, but I overlooked that some code paths call those without allocating the buffer but just for estimation. This patch fixes the bug by skipping the size check for those code paths while keeping checking in the actual transfer calls. Link: https://lore.kernel.org/r/20200403073818.27943-1-tiwai@suse.de Signed-off-by: Takashi Iwai

Merge branch 'for-next' into for-linus

2020-03-30T07:46:51Z

ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks

2020-03-12T15:58:03Z

The return value checks in snd_pcm_plug_alloc() are covered with snd_BUG_ON() macro that may trigger a kernel WARNING depending on the kconfig. But since the error condition can be triggered by a weird user space parameter passed to OSS layer, we shouldn't give the kernel stack trace just for that. As it's a normal error condition, let's remove snd_BUG_ON() macro usage there. Reported-by: syzbot+2a59ee7a9831b264f45e@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/20200312155730.7520-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: pcm: oss: Simplify plugin frame size calculations

2020-03-09T19:02:42Z

Both snd_pcm_plug_client_size() and snd_pcm_plug_slave_size() do the almost same calculations of calling src_frames() and dst_frames() in the chain, but just to the different directions with each other. This patch simplifies those functions. Now they return -EINVAL for the invalid direction, but practically seen, there is no functional changes at all. Link: https://lore.kernel.org/r/20200309185855.15693-1-tiwai@suse.de Signed-off-by: Takashi Iwai

Merge branch 'for-linus' into for-next

2020-03-09T18:50:18Z

Back-merge of 5.6 devel branch for further changes in 5.7 cycle Signed-off-by: Takashi Iwai

ALSA: pcm: oss: Avoid plugin buffer overflow

2020-03-09T08:22:22Z

Each OSS PCM plugins allocate its internal buffer per pre-calculation of the max buffer size through the chain of plugins (calling src_frames and dst_frames callbacks). This works for most plugins, but the rate plugin might behave incorrectly. The calculation in the rate plugin involves with the fractional position, i.e. it may vary depending on the input position. Since the buffer size pre-calculation is always done with the offset zero, it may return a shorter size than it might be; this may result in the out-of-bound access as spotted by fuzzer. This patch addresses those possible buffer overflow accesses by simply setting the upper limit per the given buffer size for each plugin before src_frames() and after dst_frames() calls. Reported-by: syzbot+e1fe9f44fb8ecf4fb5dd@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/000000000000b25ea005a02bcf21@google.com Link: https://lore.kernel.org/r/20200309082148.19855-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: pcm: oss: Unlock mutex temporarily for sleeping at read/write

2020-02-14T17:17:13Z

ALSA PCM OSS layer calls the generic __snd_pcm_lib_xfer() helper for the actual transfer of the audio data. The xfer helper may sleep long for waiting for the enough space becoming empty for read/write, and it does unlock/relock for the substream lock. This works fine, so far, but a slight problem specific to OSS layer is that OSS layer wraps yet more mutex (runtime->oss.params_lock) over __snd_pcm_lib_xfer() call; so this mutex is still locked during a possible long sleep, and it prevents the whole ioctl and other actions applied to the given stream. This patch adds the temporarily unlock and relock of the mutex around __snd_pcm_lib_xfer() call in the OSS layer to be more friendly to the concurrent accesses. The long mutex protection itself shouldn't be a real issue for the normal systems, and its influence appears only on strange things like fuzzers. Link: https://lore.kernel.org/r/20200214171643.26212-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: core: Replace zero-length array with flexible-array member

2020-02-12T07:14:43Z

The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertenly introduced[3] to the codebase from now on. This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200211193910.GA4596@embeddedor Signed-off-by: Takashi Iwai

ALSA: pcm: Use standard macros for fixing PCM format cast

2020-02-10T07:27:41Z

Simplify the code with the new macros for PCM format type iterations. This fixes the sparse warnings nicely: sound/core/pcm_native.c:2302:26: warning: restricted snd_pcm_format_t degrades to integer sound/core/pcm_native.c:2306:54: warning: incorrect type in argument 1 (different base types) sound/core/pcm_native.c:2306:54: expected restricted snd_pcm_format_t [usertype] format sound/core/pcm_native.c:2306:54: got unsigned int [assigned] k .... No functional changes, just sparse warning fixes. Link: https://lore.kernel.org/r/20200206163945.6797-6-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: oss: More constifications

2020-01-05T15:14:58Z

Apply const prefix to the static tables for strings and formats. Just for minor optimization and no functional changes. Link: https://lore.kernel.org/r/20200105144823.29547-41-tiwai@suse.de Signed-off-by: Takashi Iwai