* [PATCH 1/4] ALSA: jack: Fix kctl free at error in snd_jack_kctl_new()
2026-10-13 12:05 [PATCH 0/4] ALSA: yet more fixes for Sashiko bug reports Takashi Iwai
@ 2026-10-13 12:05 ` Takashi Iwai
2026-10-13 12:05 ` [PATCH 2/4] ALSA: usb-audio: Use fixed control index for us16x08 mixer elements Takashi Iwai
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Takashi Iwai @ 2026-10-13 12:05 UTC (permalink / raw)
To: linux-sound; +Cc: linux-kernel
When an error happens in snd_jack_kctl_new(), it tries to free the new
kcontrol element via snd_ctl_free_one(). But snd_ctl_free_one()
releases only the memories, and the internal linked list and hash
entries still remain, which may lead to bogus accesses to user.
Replace with the correct destructor, snd_ctl_remove(), for clearing
the whole resources of the given kcontrol, instead.
Fixes: 9058cbe1eed2 ("ALSA: jack: implement kctl creating for jack devices")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/core/jack.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/core/jack.c b/sound/core/jack.c
index 5cc9c42de981..d9132b885ea3 100644
--- a/sound/core/jack.c
+++ b/sound/core/jack.c
@@ -453,7 +453,7 @@ static struct snd_jack_kctl * snd_jack_kctl_new(struct snd_card *card, const cha
return jack_kctl;
error:
- snd_ctl_free_one(kctl);
+ snd_ctl_remove(card, kctl);
return NULL;
}
--
2.55.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/4] ALSA: usb-audio: Use fixed control index for us16x08 mixer elements
2026-10-13 12:05 [PATCH 0/4] ALSA: yet more fixes for Sashiko bug reports Takashi Iwai
2026-10-13 12:05 ` [PATCH 1/4] ALSA: jack: Fix kctl free at error in snd_jack_kctl_new() Takashi Iwai
@ 2026-10-13 12:05 ` Takashi Iwai
2026-10-14 6:13 ` Takashi Iwai
2026-10-13 12:05 ` [PATCH 3/4] ALSA: pcm: Protect delay DMA sync in forward and rewind, too Takashi Iwai
2026-10-13 12:05 ` [PATCH 4/4] ALSA: line6: Use kzalloc() for PCM buffer allocation Takashi Iwai
3 siblings, 1 reply; 6+ messages in thread
From: Takashi Iwai @ 2026-10-13 12:05 UTC (permalink / raw)
To: linux-sound; +Cc: linux-kernel
The callbacks for us16x08 mixer elements assume that id.index points
to the channel to be operated, and the assumption is correct for now.
However, since the kctls are added via snd_usb_mixer_add_control() and
it looks for the empty slot if the same control name is already
present, in theory, the index can become more than the channel numbers
(if a conflicting name really happens).
Since the mixer code in us16x08 doesn't need the search for an empty
slot but requires the fixed index, this patch changes slightly how to
assign the kcontrols. Now, a new argument is added to
snd_usb_mixer_add_list() in order to disable the empty slot search,
and use it in us16x08's add_new_ctl() helper function, instead.
Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/usb/mixer.c | 6 ++++--
sound/usb/mixer.h | 5 +++--
sound/usb/mixer_quirks.c | 2 +-
sound/usb/mixer_us16x08.c | 3 ++-
4 files changed, 10 insertions(+), 6 deletions(-)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 49a8a26f1a96..c2c24461c5a8 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -649,14 +649,16 @@ static int check_matrix_bitmap(unsigned char *bmap,
/*
* add an alsa control element
- * search and increment the index until an empty slot is found.
+ * when @look_for_empty is set, search and increment the index until an empty
+ * slot is found.
*
* if failed, give up and free the control instance.
*/
int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
struct snd_kcontrol *kctl,
- bool is_std_info)
+ bool is_std_info,
+ bool look_for_empty)
{
struct usb_mixer_interface *mixer = list->mixer;
int err;
diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
index 0d0a8b343756..c40f832852be 100644
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -113,10 +113,11 @@ int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval,
int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
struct snd_kcontrol *kctl,
- bool is_std_info);
+ bool is_std_info,
+ bool look_for_empty);
#define snd_usb_mixer_add_control(list, kctl) \
- snd_usb_mixer_add_list(list, kctl, true)
+ snd_usb_mixer_add_list(list, kctl, true, true)
void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list,
struct usb_mixer_interface *mixer,
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 1e266fdbbb8e..01210cc3fae7 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -167,7 +167,7 @@ static int add_single_ctl_with_resume(struct usb_mixer_interface *mixer,
}
kctl->private_free = snd_usb_mixer_elem_free;
/* don't use snd_usb_mixer_add_control() here, this is a special list element */
- return snd_usb_mixer_add_list(list, kctl, false);
+ return snd_usb_mixer_add_list(list, kctl, false, true);
}
/*
diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c
index b447c4f7a161..18e8c2bd2678 100644
--- a/sound/usb/mixer_us16x08.c
+++ b/sound/usb/mixer_us16x08.c
@@ -1134,7 +1134,8 @@ static int add_new_ctl(struct usb_mixer_interface *mixer,
strscpy(kctl->id.name, name, sizeof(kctl->id.name));
- err = snd_usb_mixer_add_control(&elem->head, kctl);
+ /* look_for_empty=false, as we want the fixed id.index as channel */
+ err = snd_usb_mixer_add_list(&elem->head, kctl, true, false);
if (err < 0)
return err;
--
2.55.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 3/4] ALSA: pcm: Protect delay DMA sync in forward and rewind, too
2026-10-13 12:05 [PATCH 0/4] ALSA: yet more fixes for Sashiko bug reports Takashi Iwai
2026-10-13 12:05 ` [PATCH 1/4] ALSA: jack: Fix kctl free at error in snd_jack_kctl_new() Takashi Iwai
2026-10-13 12:05 ` [PATCH 2/4] ALSA: usb-audio: Use fixed control index for us16x08 mixer elements Takashi Iwai
@ 2026-10-13 12:05 ` Takashi Iwai
2026-10-13 12:05 ` [PATCH 4/4] ALSA: line6: Use kzalloc() for PCM buffer allocation Takashi Iwai
3 siblings, 0 replies; 6+ messages in thread
From: Takashi Iwai @ 2026-10-13 12:05 UTC (permalink / raw)
To: linux-sound; +Cc: linux-kernel
Like the previous fix for snd_pcm_delay() (in the commit 50f413b83b31
"ALSA: pcm: Protect delay DMA sync against concurrent HW_FREE"), the
snd_pcm_dma_buffer_sync() call in snd_pcm_forward() and
snd_pcm_rewind() needs the similar protection against the concurrent
hw_free action for avoiding potential UAFs.
Fixes: a25684a95646 ("ALSA: memalloc: Support for non-contiguous page allocation")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/core/pcm_native.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index f774358629bb..c1bad92a4e9f 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3078,11 +3078,15 @@ static snd_pcm_sframes_t rewind_appl_ptr(struct snd_pcm_substream *substream,
static snd_pcm_sframes_t snd_pcm_rewind(struct snd_pcm_substream *substream,
snd_pcm_uframes_t frames)
{
+ struct snd_pcm_runtime *runtime = substream->runtime;
snd_pcm_sframes_t ret;
if (frames == 0)
return 0;
+ /* Keep the DMA buffer alive through the sync below. */
+ if (!atomic_inc_unless_negative(&runtime->buffer_accessing))
+ return -EBUSY;
scoped_guard(pcm_stream_lock_irq, substream) {
ret = do_pcm_hwsync(substream);
if (!ret)
@@ -3091,17 +3095,22 @@ static snd_pcm_sframes_t snd_pcm_rewind(struct snd_pcm_substream *substream,
}
if (ret >= 0)
snd_pcm_dma_buffer_sync(substream, SNDRV_DMA_SYNC_DEVICE);
+ atomic_dec(&runtime->buffer_accessing);
return ret;
}
static snd_pcm_sframes_t snd_pcm_forward(struct snd_pcm_substream *substream,
snd_pcm_uframes_t frames)
{
+ struct snd_pcm_runtime *runtime = substream->runtime;
snd_pcm_sframes_t ret;
if (frames == 0)
return 0;
+ /* Keep the DMA buffer alive through the sync below. */
+ if (!atomic_inc_unless_negative(&runtime->buffer_accessing))
+ return -EBUSY;
scoped_guard(pcm_stream_lock_irq, substream) {
ret = do_pcm_hwsync(substream);
if (!ret)
@@ -3110,6 +3119,7 @@ static snd_pcm_sframes_t snd_pcm_forward(struct snd_pcm_substream *substream,
}
if (ret >= 0)
snd_pcm_dma_buffer_sync(substream, SNDRV_DMA_SYNC_DEVICE);
+ atomic_dec(&runtime->buffer_accessing);
return ret;
}
--
2.55.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 4/4] ALSA: line6: Use kzalloc() for PCM buffer allocation
2026-10-13 12:05 [PATCH 0/4] ALSA: yet more fixes for Sashiko bug reports Takashi Iwai
` (2 preceding siblings ...)
2026-10-13 12:05 ` [PATCH 3/4] ALSA: pcm: Protect delay DMA sync in forward and rewind, too Takashi Iwai
@ 2026-10-13 12:05 ` Takashi Iwai
3 siblings, 0 replies; 6+ messages in thread
From: Takashi Iwai @ 2026-10-13 12:05 UTC (permalink / raw)
To: linux-sound; +Cc: linux-kernel
LINE6 driver allocates the PCM buffer via kmalloc(), and this might
leave some bytes uninitialized that are out of the actual ring buffer
size, while it's still exposed via mmap.
For avoiding the leak of the uninitialized kernel memory, simply
replace it with kzalloc().
Fixes: 705ececd1c60 ("Staging: add line6 usb driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/usb/line6/pcm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index f30d82cc0fc1..d17baf7761c6 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -155,7 +155,7 @@ static int line6_buffer_acquire(struct snd_line6_pcm *line6pcm,
/* Invoked multiple times in a row so allocate once only */
if (!test_and_set_bit(type, &pstr->opened) && !pstr->buffer) {
pstr->buffer =
- kmalloc(array3_size(line6pcm->line6->iso_buffers,
+ kzalloc(array3_size(line6pcm->line6->iso_buffers,
LINE6_ISO_PACKETS, pkt_size),
GFP_KERNEL);
if (!pstr->buffer)
--
2.55.0
^ permalink raw reply related [flat|nested] 6+ messages in thread