From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F6683803DC; Sat, 17 Oct 2026 17:20:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792257623; cv=none; b=OzJ+dpvj4QEkfhuuVHcJavrWk2AOnDGADwSEheX1XnMTepqNHNgm8rQZIUY6aV+Qormiy1QiuEx3P58P0XC/yHtgwmAqsAsOUeCFUXdC+vopwIZgGwU0BaALLtA6Sv3u0sLZ3c3GD8HxBfyAvFHVPhf9THw9fug0uHNzJh49zsQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792257623; c=relaxed/simple; bh=7yzDLjUn6gGIYRZx3fE+OR4pir9Uf9YYduiX4U2gjiw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EhtFrHnZCkoHnxLkLWWxIpVIrzJuuWHQFKYR3CeolPZEAS9kmJX7X+Ni1ZtyM1EL0LQVVQ1uJE9ieWbQtxl2F0DfIhOhyXrtjeIt+DSD6dv2J/SVtN7S0K4Has/svPg0wEualz8U6xzCJ+wCrv6X/QQZv2oWuzo9+uDwwfhxkBo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=njL1lEFD; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="njL1lEFD" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DB0261F000C4; Sat, 17 Oct 2026 17:20:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792257622; bh=WsYnbQB56N0iuyhwLCzrW++nhqqA8Bc2xbkTbzV5Z7s=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=njL1lEFDNbsmhKziMDj3uI+WPDTx/1lWSc2/2Q5HAYj8tQIVRXiclTjD0K46DUEPn RVY9y4kxnRGIqZOpe8n5jZ3WZyWG7+a716oNYUXJIxI83O9VEKpFRRnJbUDOK49EqV A6Yc2TRioHvC0RrMsw48d3UfsGWbO5VrU0B/6cfU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Takashi Iwai , Artem Dinaburg , Sasha Levin , Jaeyoung Chung Subject: [PATCH 6.6 0576/1674] ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Date: Sat, 17 Oct 2026 17:47:28 +0200 Message-ID: <20261017160445.877676064@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261017160431.119607952@linuxfoundation.org> References: <20261017160431.119607952@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Takashi Iwai [ Upstream commit 901ac0ff15edf9503162e2cf6579bd11a30f1ed4 ] Currently the runtime.oss.trigger field may be accessed concurrently without protection, which may lead to the data race. And, in this case, it may lead to more severe problem because it's a bit field; as writing the data, it may overwrite other bit fields as well, which confuses the operation completely, as spotted by fuzzing. Fix it by covering runtime.oss.trigger bit fled also with the existing params_lock mutex in both snd_pcm_oss_get_trigger() and snd_pcm_oss_poll(). Reported-and-tested-by: Jaeyoung Chung Closes: https://lore.kernel.org/20260423145330.210035-1-jjy600901@snu.ac.kr Cc: Link: https://patch.msgid.link/20260424112205.123703-1-tiwai@suse.de Signed-off-by: Takashi Iwai Assisted-by: LLM [ Backport to 6.6.y: Replace upstream mutex guards with explicit params_lock operations and matching unlocks; the target has no scoped locking helpers. ] Signed-off-by: Artem Dinaburg Signed-off-by: Sasha Levin --- sound/core/oss/pcm_oss.c | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-) diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 25f7e585bc7b9..15683237c7ee7 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -2161,10 +2161,18 @@ static int snd_pcm_oss_get_trigger(struct snd_pcm_oss_file *pcm_oss_file) psubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK]; csubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE]; - if (psubstream && psubstream->runtime && psubstream->runtime->oss.trigger) - result |= PCM_ENABLE_OUTPUT; - if (csubstream && csubstream->runtime && csubstream->runtime->oss.trigger) - result |= PCM_ENABLE_INPUT; + if (psubstream && psubstream->runtime) { + mutex_lock(&psubstream->runtime->oss.params_lock); + if (psubstream->runtime->oss.trigger) + result |= PCM_ENABLE_OUTPUT; + mutex_unlock(&psubstream->runtime->oss.params_lock); + } + if (csubstream && csubstream->runtime) { + mutex_lock(&csubstream->runtime->oss.params_lock); + if (csubstream->runtime->oss.trigger) + result |= PCM_ENABLE_INPUT; + mutex_unlock(&csubstream->runtime->oss.params_lock); + } return result; } @@ -2839,6 +2847,18 @@ static int snd_pcm_oss_capture_ready(struct snd_pcm_substream *substream) runtime->oss.period_frames; } +static bool need_input_retrigger(struct snd_pcm_runtime *runtime) +{ + bool ret; + + mutex_lock(&runtime->oss.params_lock); + ret = runtime->oss.trigger; + if (ret) + runtime->oss.trigger = 0; + mutex_unlock(&runtime->oss.params_lock); + return ret; +} + static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait) { struct snd_pcm_oss_file *pcm_oss_file; @@ -2871,11 +2891,11 @@ static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait) snd_pcm_oss_capture_ready(csubstream)) mask |= EPOLLIN | EPOLLRDNORM; snd_pcm_stream_unlock_irq(csubstream); - if (ostate != SNDRV_PCM_STATE_RUNNING && runtime->oss.trigger) { + if (ostate != SNDRV_PCM_STATE_RUNNING && + need_input_retrigger(runtime)) { struct snd_pcm_oss_file ofile; memset(&ofile, 0, sizeof(ofile)); ofile.streams[SNDRV_PCM_STREAM_CAPTURE] = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE]; - runtime->oss.trigger = 0; snd_pcm_oss_set_trigger(&ofile, PCM_ENABLE_INPUT); } } -- 2.53.0