Commit e190161f authored Jan 25, 2019 by Takashi Iwai

ALSA: pcm: Fix tight loop of OSS capture stream



When the trigger=off is passed for a PCM OSS stream, it sets the
start_threshold of the given substream to the boundary size, so that
it won't be automatically started.  This can be problematic for a
capture stream, unfortunately, as detected by syzkaller.  The scenario
is like the following:

- In __snd_pcm_lib_xfer() that is invoked from snd_pcm_oss_read()
  loop, we have a check whether the stream was already started or the
  stream can be auto-started.
- The function at this check returns 0 with trigger=off since we
  explicitly disable the auto-start.
- The loop continues and repeats calling __snd_pcm_lib_xfer() tightly,
  which may lead to an RCU stall.

This patch fixes the bug by simply allowing the wait for non-started
stream in the case of OSS capture.  For native usages, it's supposed
to be done by the caller side (which is user-space), hence it returns
zero like before.

(In theory, __snd_pcm_lib_xfer() could wait even for the native API
 usage cases, too; but I'd like to stay in a safer side for not
 breaking the existing stuff for now.)

Reported-by:  <syzbot+fbe0496f92a0ce7b786c@syzkaller.appspotmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

parent 9e696664

sound/core/pcm_lib.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -2112,6 +2112,13 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream,
		return 0;
		}

		/* allow waiting for a capture stream that hasn't been started */
		#if IS_ENABLED(CONFIG_SND_PCM_OSS)
		#define wait_capture_start(substream) ((substream)->oss.oss)
		#else
		#define wait_capture_start(substream) false
		#endif

		/* the common loop for read/write data */
		snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
		void *data, bool interleaved,
		@@ -2182,7 +2189,7 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
		err = snd_pcm_start(substream);
		if (err < 0)
		goto _end_unlock;
		} else {
		} else if (!wait_capture_start(substream)) {
		/* nothing to do */
		err = 0;
		goto _end_unlock;

Admin message