Patch "ALSA: pcm: Fix potential deadlock in OSS emulation" has been added to the 3.14-stable tree

This is a note to let you know that I've just added the patch titled

ALSA: pcm: Fix potential deadlock in OSS emulation

to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
alsa-pcm-fix-potential-deadlock-in-oss-emulation.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Takashi Iwai <[email protected]>
Date: Sun, 31 Jan 2016 10:32:37 +0100
Subject: ALSA: pcm: Fix potential deadlock in OSS emulation

From: Takashi Iwai <[email protected]>

commit b248371628aad599a48540962f6b85a21a8a0c3f upstream.

There are potential deadlocks in PCM OSS emulation code while accessing read/write and mmap concurrently. This comes from the infamous mmap_sem usage in copy_from/to_user(). Namely,

snd_pcm_oss_write() ->

     &runtime->oss.params_lock ->
        copy_to_user() ->
          &mm->mmap_sem
  mmap() ->
    &mm->mmap_sem ->
      snd_pcm_oss_mmap() ->
        &runtime->oss.params_lock

Since we can't avoid taking params_lock from mmap code path, use trylock variant and aborts with -EAGAIN as a workaround of this AB/BA deadlock.

---
 sound/core/oss/pcm_oss.c |   21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

@@ -834,7 +834,8 @@ static int choose_rate(struct snd_pcm_su
 	return snd_pcm_hw_param_near(substream, params, SNDRV_PCM_HW_PARAM_RATE, best_rate, NULL);
 }
 
-static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream)
+static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream,
+				     bool trylock)
 {
 	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct snd_pcm_hw_params *params, *sparams;

@@ -848,7 +849,10 @@ static int snd_pcm_oss_change_params(str
 	struct snd_mask sformat_mask;
 	struct snd_mask mask;
 
-	if (mutex_lock_interruptible(&runtime->oss.params_lock))
+	if (trylock) {
+		if (!(mutex_trylock(&runtime->oss.params_lock)))
+			return -EAGAIN;
+	} else if (mutex_lock_interruptible(&runtime->oss.params_lock))
 		return -EINTR;
 	sw_params = kmalloc(sizeof(*sw_params), GFP_KERNEL);
 	params = kmalloc(sizeof(*params), GFP_KERNEL);

@@ -1091,7 +1095,7 @@ static int snd_pcm_oss_get_active_substr
 		if (asubstream == NULL)
 			asubstream = substream;
 		if (substream->runtime->oss.params) {
-			err = snd_pcm_oss_change_params(substream);
+			err = snd_pcm_oss_change_params(substream, false);
 			if (err < 0)
 				return err;
 		}

@@ -1130,7 +1134,7 @@ static int snd_pcm_oss_make_ready(struct
 		return 0;
 	runtime = substream->runtime;
 	if (runtime->oss.params) {
-		err = snd_pcm_oss_change_params(substream);
+		err = snd_pcm_oss_change_params(substream, false);
 		if (err < 0)
 			return err;
 	}

@@ -2168,7 +2172,7 @@ static int snd_pcm_oss_get_space(struct
 	runtime = substream->runtime;
 
 	if (runtime->oss.params &&
-	    (err = snd_pcm_oss_change_params(substream)) < 0)
+	    (err = snd_pcm_oss_change_params(substream, false)) < 0)
 		return err;
 
 	info.fragsize = runtime->oss.period_bytes;

@@ -2804,7 +2808,12 @@ static int snd_pcm_oss_mmap(struct file
 		return -EIO;
 	
 	if (runtime->oss.params) {
-		if ((err = snd_pcm_oss_change_params(substream)) < 0)
+		/* use mutex_trylock() for params_lock for avoiding a deadlock
+		 * between mmap_sem and params_lock taken by
+		 * copy_from/to_user() in snd_pcm_oss_write/read()
+		 */
+		err = snd_pcm_oss_change_params(substream, true);
+		if (err < 0)
 			return err;
 	}
 #ifdef CONFIG_SND_PCM_OSS_PLUGINS

Patches currently in stable-queue which might be from [email protected] are

queue-3.14/alsa-seq-fix-race-at-closing-in-virmidi-driver.patch queue-3.14/alsa-rawmidi-remove-kernel-warning-for-null-user-space-buffer-check.patch queue-3.14/alsa-hda-fix-static-checker-warning-in-patch_hdmi.c.patch queue-3.14/alsa-seq-fix-lockdep-warnings-due-to-double-mutex-locks.patch queue-3.14/alsa-usb-audio-fix-teac-ud-501-ud-503-nt-503-usb-delay.patch queue-3.14/alsa-timer-fix-wrong-instance-passed-to-slave-callbacks.patch queue-3.14/alsa-compress-disable-get_codec_caps-ioctl-for-some-architectures.patch queue-3.14/alsa-hda-fix-speaker-output-from-vaio-aio-machines.patch queue-3.14/alsa-dummy-implement-timer-backend-switching-more-safely.patch queue-3.14/alsa-dummy-disable-switching-timer-backend-via-sysfs.patch queue-3.14/alsa-seq-fix-incorrect-sanity-check-at-snd_seq_oss_synth_cleanup.patch queue-3.14/alsa-seq-fix-yet-another-races-among-alsa-timer-accesses.patch queue-3.14/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch queue-3.14/alsa-hda-add-fixup-for-mac-mini-7-1-model.patch queue-3.14/alsa-timer-fix-leftover-link-at-closing.patch queue-3.14/alsa-rawmidi-fix-race-at-copying-updating-the-position.patch queue-3.14/alsa-pcm-fix-potential-deadlock-in-oss-emulation.patch queue-3.14/alsa-timer-fix-link-corruption-due-to-double-start-or-stop.patch