Takashi Iwai
c13f1463d8
ALSA: rawmidi: Fix racy buffer resize under concurrent accesses ...
commit c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d upstream.
The rawmidi core allows user to resize the runtime buffer via ioctl,
and this may lead to UAF when performed during concurrent reads or
writes: the read/write functions unlock the runtime lock temporarily
during copying form/to user-space, and that's the race window.
This patch fixes the hole by introducing a reference counter for the
runtime buffer read/write access and returns -EBUSY error when the
resize is performed concurrently against read/write.
Note that the ref count field is a simple integer instead of
refcount_t here, since the all contexts accessing the buffer is
basically protected with a spinlock, hence we need no expensive atomic
ops. Also, note that this busy check is needed only against read /
write functions, and not in receive/transmit callbacks; the race can
happen only at the spinlock hole mentioned in the above, while the
whole function is protected for receive / transmit callbacks.
Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/CAFcO6XMWpUVK_yzzCpp8_XP7+=oUpQvuBeCbMffEDkpe8jWrfg@mail.gmail.com
Link: https://lore.kernel.org/r/s5heerw3r5z.wl-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-20 08:15:40 +02:00
ASoC: ac97: add gpio chip
2015-11-18 18:08:54 +00:00
ALSA: ad1816a: Remove always NULL parameters
2015-01-02 16:26:20 +01:00
ASoC: TI AESS: add autogating-enable function, callable from architecture code
2013-02-10 11:22:23 -07:00
ALSA: ak411x: Fix race of reinit() calls
2015-01-28 22:30:18 +01:00
ALSA: ak411x: Fix race of reinit() calls
2015-01-28 22:30:18 +01:00
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
2012-10-02 18:01:25 +01:00
UAPI: (Scripted) Disintegrate include/sound
2012-10-09 09:49:13 +01:00
UAPI: (Scripted) Disintegrate include/sound
2012-10-09 09:49:13 +01:00
dmaengine: dw: move dw_dmac.h to where it belongs to
2014-09-11 11:48:12 +05:30
dmaengine: dw: move dw_dmac.h to where it belongs to
2014-09-11 11:48:12 +05:30
ALSA: compress: Fix regression on compressed capture streams
2019-08-25 10:51:26 +02:00
ALSA: control: Hardening for potential Spectre v1
2018-05-01 15:13:06 -07:00
ALSA: hda_intel: add card number to irq description
2016-01-12 21:05:16 +01:00
ASoC: cs35l33: Initial commit of the cs35l33 CODEC driver.
2016-06-27 17:39:06 +01:00
ASoC: cs42l52: Make MICA/B mixer dependent on mic config
2013-11-28 10:20:51 +00:00
ASoC: Add support for CS42L56 CODEC
2014-05-05 18:20:22 -07:00
ASoC: cs42l73: Add platform data support for cs42l73 codec
2013-10-18 00:37:29 +01:00
ALSA: ASoC: cs4271: add optional soft reset workaround
2012-12-24 15:53:28 +00:00
ALSA: cs8427: separate HW initialization
2014-04-03 14:59:48 +02:00
ASoC: da7213: Add support to handle mclk data provided to driver
2015-10-07 15:11:34 +01:00
ASoC: da7218: Add da7218 codec driver
2015-11-30 12:24:12 +00:00
ASoC: codecs: Add da7219 codec driver
2015-10-02 18:11:27 +01:00
ASoC: da7219: Disable AAD if codec is not a wake-up source
2016-09-26 09:39:50 -07:00
ASoC: codecs: Add DA9055 codec driver
2012-09-28 14:21:54 +01:00
ASoC: dwc: add quirk to override COMP_PARAM_1 register
2016-01-10 12:11:50 +00:00
ASoC: dmaengine_pcm: Add support for packed transfers
2016-04-27 17:34:11 +01:00
ALSA: emu10k1: Emu10k2 32 bit DMA mode
2015-04-29 07:27:30 +02:00
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
2012-10-02 18:01:25 +01:00
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
2012-10-02 18:01:25 +01:00
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
2012-10-02 18:01:25 +01:00
ALSA: emux: Fix/cleanup old ifdef CONFIG_PROC_FS
2015-05-29 07:58:11 +02:00
ALSA: es1688: Remove almost always NULL parameter
2015-01-02 16:27:03 +01:00
ALSA: Include linux/io.h instead of asm/io.h
2015-01-28 16:49:33 +01:00
ALSA: hda - Update chmap tlv to report sink's capability
2016-04-04 16:04:24 +02:00
Merge branch 'for-linus' into for-next
2016-04-26 10:12:46 +02:00
ALSA - hda: Add support for parsing new HDA capabilities
2016-08-09 08:53:56 +02:00
ALSA: hda - Fix possible race on regmap bypass flip
2016-04-21 17:59:17 +02:00
ALSA: hda - Split verb definitions into sound/hda_verbs.h
2013-12-09 17:31:40 +01:00
ALSA: hda - move bus_parse_capabilities to core
2016-08-09 08:53:56 +02:00
ALSA - Ext hda: remove bus_parse_capabilities
2016-08-09 08:53:56 +02:00
ASoC: hdmi-codec: use unsigned type to structure members with bit-field
2017-01-19 20:18:02 +01:00
ALSA: hwdep: Embed struct device
2015-02-02 14:42:42 +01:00
ALSA: i2c: constify snd_i2c_ops structures
2015-11-30 11:40:08 +01:00
ALSA: replace CONFIG_PROC_FS with CONFIG_SND_PROC_FS
2015-05-27 21:25:19 +02:00
ALSA: isa: Move snd_legacy_find_free_ioport to initval.h
2012-08-03 12:57:44 +02:00
ALSA: jack: Allow building the jack layer without input device
2016-02-23 09:03:07 +01:00
ASoC: L3 bus: Add default gpio ops
2016-08-08 11:55:20 +01:00
ASoC:: max98090: Remove executable bit
2013-03-20 10:54:12 +01:00
ALSA: Remove memory reservation code from memalloc helper
2014-01-09 07:32:10 +01:00
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
2012-10-02 18:01:25 +01:00
omapdss: hdmi audio: Make header file independent of video/omapdss.h
2016-06-03 16:06:36 +03:00
ASoC: omap-pcm: Move omap-pcm under include/sound
2014-05-26 15:32:32 +01:00
ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command
2019-05-16 19:43:44 +02:00
ALSA: pcm: add DRM ELD helper
2015-05-22 16:01:44 +02:00
ALSA: pcm: add IEC958 channel status helper for hw_params
2016-04-06 11:47:48 -07:00
ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams
2018-04-24 09:34:15 +02:00
ALSA: pcm: Fix interval evaluation with openmin/max
2018-12-13 09:20:28 +01:00
ASoC: pxa: pxa-pcm-lib: switch over to snd-soc-dmaengine-pcm
2015-09-30 23:21:16 +01:00
ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
2020-05-20 08:15:40 +02:00
ASoC: add RT286 CODEC driver
2014-07-04 18:50:51 +01:00
ASoC: add rt298 codec driver
2015-07-09 12:00:11 +01:00
ASoC: rt5640: Fill up the IN3's support
2015-10-22 13:33:00 +01:00
ASoC: rt5645: Add jd_invert for Broadwell
2015-09-22 09:46:33 -07:00
ASoC: add RT5651 CODEC driver
2014-04-18 18:52:18 +01:00
ASoC: rt5659: add rt5659 codec driver
2015-11-18 12:55:25 +00:00
ASoC: rt5660: add rt5660 codec driver
2016-09-24 19:51:57 +01:00
ASoC: rt5670: Add IRQ function
2015-03-11 12:08:20 +00:00
ASoC: rt5677: Add the MICBIAS VDD setting in the platform data
2015-01-08 18:36:02 +00:00
ASoC: s3c24xx_uda134x: Remove unused power() callback
2016-08-08 11:55:20 +01:00
ALSA: Include linux/io.h instead of asm/io.h
2015-01-28 16:49:33 +01:00
UAPI: (Scripted) Disintegrate include/sound
2012-10-09 09:49:13 +01:00
ALSA: seq: Define driver object in each driver
2015-02-12 14:15:54 +01:00
ALSA: seq: Avoid invalid lockdep class warning
2017-11-15 15:53:18 +01:00
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
2012-10-02 18:01:25 +01:00
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
2012-10-02 18:01:25 +01:00
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
2012-10-02 18:01:25 +01:00
ALSA: seq: Fix copy_from_user() call inside lock
2017-10-18 09:35:40 +02:00
ASoC: fsi: cleanup sh_fsi.h
2012-12-24 15:57:20 +00:00
ASoC: simple-card: use asoc_simple_card_parse_daifmt()
2016-07-01 17:34:02 +02:00
ASoC: simple-card-utils: add __printf attribute
2016-08-24 16:27:04 +01:00
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
2012-10-02 18:01:25 +01:00
ASoC: Support registering a DAI dynamically
2016-01-10 12:06:19 +00:00
ASoC: Define a set of DAPM pre/post-up events
2019-10-17 13:42:04 -07:00
ASoC: Make soc_dpcm_debugfs_add() non-fatal
2015-04-09 11:32:29 +01:00
ASoC: topology: Add FE DAI links dynamically
2016-02-15 19:38:19 +00:00
Merge remote-tracking branches 'asoc/topic/nau8810', 'asoc/topic/of-bool', 'asoc/topic/omap' and 'asoc/topic/platform-drvdata' into asoc-next
2016-09-29 12:44:31 -07:00
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
2012-10-02 18:01:25 +01:00
ASoC: Update email-id of Rajeev Kumar
2015-04-28 16:31:01 +01:00
ASoC: SPEAr spdif_in: Add spdif IN support
2012-06-23 11:58:10 +01:00
ASoC: sta32x: add device tree binding.
2015-01-27 17:13:25 +00:00
ASoC: sta350: add support for bits in miscellaneous registers
2014-05-05 12:52:59 -07:00
ASoC: tas2552: Support TI TAS2552 Amplifier
2014-07-17 17:57:05 +01:00
ALSA: ASoC: add codec driver for TI TAS5086
2013-03-08 21:06:09 +08:00
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
2012-10-02 18:01:25 +01:00
ALSA: timer: Limit max instances per timer
2019-11-06 12:18:28 +01:00
ALSA: control: cage TLV_DB_RANGE_HEAD in kernel land because it was obsoleted
2016-09-25 22:16:49 +02:00
ASoC: tlv320aic3x: Convert mic bias to a supply widget
2013-02-04 18:35:19 +00:00
ASoC: tlv320aic32x4: Add rstn gpio to platform data.
2012-11-01 14:35:56 +00:00
ASoC: uda134x: Remove is_powered_on_standby from platform data
2014-11-24 18:04:49 +00:00
ALSA: vx: Use nonatomic PCM ops
2014-09-15 15:52:03 +02:00
ASoC: wm0010: Add initial wm0010 DSP driver
2012-08-23 16:12:12 +01:00
ASoC: wm2000: Use clock API integration to configure MCLK divisor
2012-12-24 15:42:35 +00:00
ASoC: wm2200: Provide platform data for MICBIAS configuration
2013-02-05 15:53:07 +00:00
ASoC: wm8904: Correct number of EQ registers
2015-10-20 15:46:09 +01:00
ASoC: wm8960: remove 'dres' field from platform data structure
2012-09-21 08:35:06 -04:00
ASoC: wm8962: Let CODEC driver enable and disable its own MCLK
2014-07-31 20:51:26 +01:00
ASoC: wm_hubs: Allow configuration of MICBIAS power up delay via pdata
2012-08-22 19:00:37 +01:00
ALSA: wss: Remove (almost) always NULL parameters
2015-01-02 16:30:08 +01:00
c13f1463d8