sound: another WARNING in rawmidi_transmit_ack
diff mbox

Message ID s5hy4b4myqm.wl-tiwai@suse.de
State New
Headers show

Commit Message

Takashi Iwai Feb. 1, 2016, 11:55 a.m. UTC
On Mon, 01 Feb 2016 12:31:20 +0100,
Dmitry Vyukov wrote:
> 
> Hello,
> 
> The following program triggers a splash of WARNINGs in rawmidi_transmit_ack.
> Takashi, I am on commit 36f90b0a2ddd60823fe193a85e60ff1906c2a9b3 + a
> bunch of your recent fixes:
> https://gist.githubusercontent.com/dvyukov/40640128a433ad16a56a/raw/ab3a08637ce3654b969b778c5700fe4a80f14456/gistfile1.txt

Ouch, this is another spot with an open race between
snd_rawmidi_transmit_peek() and snd_rawmidi_transmit_ack().

Could you drop the previous fix and apply the one below instead?

FWIW, I pushed sound.git tree topic/core-fixes branch containing all
pending fixes.  This should be pullable cleanly onto 4.5-rc1/rc2.

 git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git topic/core-fixes


Thanks!

Takashi

-- 8< --
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free

A kernel WARNING in snd_rawmidi_transmit_ack() is triggered by
syzkaller fuzzer:
  WARNING: CPU: 1 PID: 20739 at sound/core/rawmidi.c:1136
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82999e2d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
 [<ffffffff81352089>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
 [<ffffffff813522b9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
 [<ffffffff84f80bd5>] snd_rawmidi_transmit_ack+0x275/0x400 sound/core/rawmidi.c:1136
 [<ffffffff84fdb3c1>] snd_virmidi_output_trigger+0x4b1/0x5a0 sound/core/seq/seq_virmidi.c:163
 [<     inline     >] snd_rawmidi_output_trigger sound/core/rawmidi.c:150
 [<ffffffff84f87ed9>] snd_rawmidi_kernel_write1+0x549/0x780 sound/core/rawmidi.c:1223
 [<ffffffff84f89fd3>] snd_rawmidi_write+0x543/0xb30 sound/core/rawmidi.c:1273
 [<ffffffff817b0323>] __vfs_write+0x113/0x480 fs/read_write.c:528
 [<ffffffff817b1db7>] vfs_write+0x167/0x4a0 fs/read_write.c:577
 [<     inline     >] SYSC_write fs/read_write.c:624
 [<ffffffff817b50a1>] SyS_write+0x111/0x220 fs/read_write.c:616
 [<ffffffff86336c36>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185

Also a similar warning is found but in another path:
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82be2c0d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
 [<ffffffff81355139>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
 [<ffffffff81355369>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
 [<ffffffff8527e69a>] rawmidi_transmit_ack+0x24a/0x3b0 sound/core/rawmidi.c:1133
 [<ffffffff8527e851>] snd_rawmidi_transmit_ack+0x51/0x80 sound/core/rawmidi.c:1163
 [<ffffffff852d9046>] snd_virmidi_output_trigger+0x2b6/0x570 sound/core/seq/seq_virmidi.c:185
 [<     inline     >] snd_rawmidi_output_trigger sound/core/rawmidi.c:150
 [<ffffffff85285a0b>] snd_rawmidi_kernel_write1+0x4bb/0x760 sound/core/rawmidi.c:1252
 [<ffffffff85287b73>] snd_rawmidi_write+0x543/0xb30 sound/core/rawmidi.c:1302
 [<ffffffff817ba5f3>] __vfs_write+0x113/0x480 fs/read_write.c:528
 [<ffffffff817bc087>] vfs_write+0x167/0x4a0 fs/read_write.c:577
 [<     inline     >] SYSC_write fs/read_write.c:624
 [<ffffffff817bf371>] SyS_write+0x111/0x220 fs/read_write.c:616
 [<ffffffff86660276>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185

In the former case, the reason is that virmidi has an open code
calling snd_rawmidi_transmit_ack() with the value calculated outside
the spinlock.   We may use snd_rawmidi_transmit() in a loop just for
consuming the input data, but even there, there is a race between
snd_rawmidi_transmit_peek() and snd_rawmidi_tranmit_ack().

Similarly in the latter case, it calls snd_rawmidi_transmit_peek() and
snd_rawmidi_tranmit_ack() separately without protection, so they are
racy as well.

The patch tries to address these issues by the following ways:
- Introduce the unlocked versions of snd_rawmidi_transmit_peek() and
  snd_rawmidi_transmit_ack() to be called inside the explicit lock.
- Rewrite snd_rawmidi_transmit() to be race-free (the former case).
- Make the split calls (the latter case) protected in the rawmidi spin
  lock.

BugLink: http://lkml.kernel.org/r/CACT4Y+YPq1+cYLkadwjWa5XjzF1_Vki1eHnVn-Lm0hzhSpu5PA@mail.gmail.com
BugLink: http://lkml.kernel.org/r/CACT4Y+acG4iyphdOZx47Nyq_VHGbpJQK-6xNpiqUjaZYqsXOGw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 include/sound/rawmidi.h      |  4 ++
 sound/core/rawmidi.c         | 97 ++++++++++++++++++++++++++++++++------------
 sound/core/seq/seq_virmidi.c | 14 +++++--
 3 files changed, 85 insertions(+), 30 deletions(-)

Comments

Dmitry Vyukov Feb. 2, 2016, 9:59 p.m. UTC | #1
On Mon, Feb 1, 2016 at 12:55 PM, Takashi Iwai <tiwai@suse.de> wrote:
> On Mon, 01 Feb 2016 12:31:20 +0100,
> Dmitry Vyukov wrote:
>>
>> Hello,
>>
>> The following program triggers a splash of WARNINGs in rawmidi_transmit_ack.
>> Takashi, I am on commit 36f90b0a2ddd60823fe193a85e60ff1906c2a9b3 + a
>> bunch of your recent fixes:
>> https://gist.githubusercontent.com/dvyukov/40640128a433ad16a56a/raw/ab3a08637ce3654b969b778c5700fe4a80f14456/gistfile1.txt
>
> Ouch, this is another spot with an open race between
> snd_rawmidi_transmit_peek() and snd_rawmidi_transmit_ack().
>
> Could you drop the previous fix and apply the one below instead?
>
> FWIW, I pushed sound.git tree topic/core-fixes branch containing all
> pending fixes.  This should be pullable cleanly onto 4.5-rc1/rc2.
>
>  git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git topic/core-fixes
>
>
> Thanks!
>
> Takashi


Now this program hangs the machine with:

[ 2101.730005] NMI backtrace for cpu 3
[ 2101.730005] CPU: 3 PID: 32283 Comm: a.out Not tainted 4.5.0-rc2+ #307
[ 2101.730005] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS Bochs 01/01/2011
[ 2101.730005] task: ffff880061c1df00 ti: ffff8800632c0000 task.ti:
ffff8800632c0000
[ 2101.730005] RIP: 0010:[<ffffffff82c0ff55>]  [<ffffffff82c0ff55>]
delay_tsc+0x25/0x70
[ 2101.730005] RSP: 0018:ffff8800632c7ab8  EFLAGS: 00000006
[ 2101.730005] RAX: 00000000884b1cf5 RBX: ffff88006540d380 RCX: 000000000000001e
[ 2101.730005] RDX: 0000051300000000 RSI: 00000513884b1cf5 RDI: 0000000000000001
[ 2101.730005] RBP: ffff8800632c7ab8 R08: 0000000000000003 R09: 0000000000000001
[ 2101.730005] R10: ffff880061c1df00 R11: ffff88006540d398 R12: ffff88006540d390
[ 2101.730005] R13: 000000009a9d2d40 R14: ffff88006540d388 R15: 000000009a849c5e
[ 2101.730005] FS:  00007f3f0b1f6700(0000) GS:ffff88006d700000(0000)
knlGS:0000000000000000
[ 2101.730005] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 2101.730005] CR2: 0000000020d8b000 CR3: 0000000061117000 CR4: 00000000000006e0
[ 2101.730005] Stack:
[ 2101.730005]  ffff8800632c7ac8 ffffffff82c0fe9a ffff8800632c7b00
ffffffff81467999
[ 2101.730005]  ffff88006540d380 ffff8800655b9e00 1ffff1000c658fa1
ffff88006540d338
[ 2101.730005]  ffff8800632c7cb8 ffff8800632c7b20 ffffffff86660b2f
ffffffff8528758b
[ 2101.730005] Call Trace:
[ 2101.730005]  [<ffffffff82c0fe9a>] __delay+0xa/0x10
[ 2101.730005]  [<ffffffff81467999>] do_raw_spin_lock+0x149/0x2b0
[ 2101.730005]  [<ffffffff86660b2f>] _raw_spin_lock_irq+0x6f/0x80
[ 2101.730005]  [<ffffffff8528758b>] ? snd_rawmidi_write+0x21b/0xb30
[ 2101.730005]  [<ffffffff8528758b>] snd_rawmidi_write+0x21b/0xb30
[ 2101.730005]  [<ffffffff85287370>] ? snd_rawmidi_release+0xf0/0xf0
[ 2101.730005]  [<ffffffff81794e1f>] ? get_mem_cgroup_from_mm+0x39f/0x4a0
[ 2101.730005]  [<ffffffff8168131e>] ? __lru_cache_add+0xce/0x1d0
[ 2101.730005]  [<ffffffff816f1d02>] ? handle_mm_fault+0x3042/0x49a0
[ 2101.730005]  [<ffffffff81456670>] ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 2101.730005]  [<ffffffff817ba743>] __vfs_write+0x113/0x4b0
[ 2101.730005]  [<ffffffff85287370>] ? snd_rawmidi_release+0xf0/0xf0
[ 2101.730005]  [<ffffffff817ba630>] ? vfs_iter_write+0x360/0x360
[ 2101.730005]  [<ffffffff829e5f95>] ? common_file_perm+0x155/0x3a0
[ 2101.730005]  [<ffffffff829e63f2>] ? apparmor_file_permission+0x22/0x30
[ 2101.730005]  [<ffffffff8291cc4c>] ? security_file_permission+0x8c/0x1f0
[ 2101.730005]  [<ffffffff817bbbd2>] ? rw_verify_area+0x102/0x2c0
[ 2101.730005]  [<ffffffff817bc207>] vfs_write+0x167/0x4a0
[ 2101.730005]  [<ffffffff817bf4f1>] SyS_write+0x111/0x220
[ 2101.730005]  [<ffffffff817bf3e0>] ? SyS_read+0x220/0x220
[ 2101.730005]  [<ffffffff81005017>] ? trace_hardirqs_on_thunk+0x17/0x19
[ 2101.730005]  [<ffffffff86661376>] entry_SYSCALL_64_fastpath+0x16/0x7a

Patch
diff mbox

diff --git a/include/sound/rawmidi.h b/include/sound/rawmidi.h
index fdabbb4ddba9..f730b91e472f 100644
--- a/include/sound/rawmidi.h
+++ b/include/sound/rawmidi.h
@@ -167,6 +167,10 @@  int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
 int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count);
 int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
 			 unsigned char *buffer, int count);
+int __snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+			      unsigned char *buffer, int count);
+int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream,
+			       int count);
 
 /* main midi functions */
 
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index f75d1656272c..c26ec9be59e8 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -1055,23 +1055,16 @@  int snd_rawmidi_transmit_empty(struct snd_rawmidi_substream *substream)
 EXPORT_SYMBOL(snd_rawmidi_transmit_empty);
 
 /**
- * snd_rawmidi_transmit_peek - copy data from the internal buffer
+ * __snd_rawmidi_transmit_peek - copy data from the internal buffer
  * @substream: the rawmidi substream
  * @buffer: the buffer pointer
  * @count: data size to transfer
  *
- * Copies data from the internal output buffer to the given buffer.
- *
- * Call this in the interrupt handler when the midi output is ready,
- * and call snd_rawmidi_transmit_ack() after the transmission is
- * finished.
- *
- * Return: The size of copied data, or a negative error code on failure.
+ * This is a variant of snd_rawmidi_transmit_peek() without spinlock.
  */
-int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+int __snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
 			      unsigned char *buffer, int count)
 {
-	unsigned long flags;
 	int result, count1;
 	struct snd_rawmidi_runtime *runtime = substream->runtime;
 
@@ -1081,7 +1074,6 @@  int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
 		return -EINVAL;
 	}
 	result = 0;
-	spin_lock_irqsave(&runtime->lock, flags);
 	if (runtime->avail >= runtime->buffer_size) {
 		/* warning: lowlevel layer MUST trigger down the hardware */
 		goto __skip;
@@ -1106,25 +1098,47 @@  int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
 		}
 	}
       __skip:
+	return result;
+}
+EXPORT_SYMBOL(__snd_rawmidi_transmit_peek);
+
+/**
+ * snd_rawmidi_transmit_peek - copy data from the internal buffer
+ * @substream: the rawmidi substream
+ * @buffer: the buffer pointer
+ * @count: data size to transfer
+ *
+ * Copies data from the internal output buffer to the given buffer.
+ *
+ * Call this in the interrupt handler when the midi output is ready,
+ * and call snd_rawmidi_transmit_ack() after the transmission is
+ * finished.
+ *
+ * Return: The size of copied data, or a negative error code on failure.
+ */
+int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+			      unsigned char *buffer, int count)
+{
+	struct snd_rawmidi_runtime *runtime = substream->runtime;
+	int result;
+	unsigned long flags;
+
+	spin_lock_irqsave(&runtime->lock, flags);
+	result = __snd_rawmidi_transmit_peek(substream, buffer, count);
 	spin_unlock_irqrestore(&runtime->lock, flags);
 	return result;
 }
 EXPORT_SYMBOL(snd_rawmidi_transmit_peek);
 
 /**
- * snd_rawmidi_transmit_ack - acknowledge the transmission
+ * __snd_rawmidi_transmit_ack - acknowledge the transmission
  * @substream: the rawmidi substream
  * @count: the transferred count
  *
- * Advances the hardware pointer for the internal output buffer with
- * the given size and updates the condition.
- * Call after the transmission is finished.
- *
- * Return: The advanced size if successful, or a negative error code on failure.
+ * This is a variant of __snd_rawmidi_transmit_ack() without spinlock.
  */
-int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
+int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
 {
-	unsigned long flags;
 	struct snd_rawmidi_runtime *runtime = substream->runtime;
 
 	if (runtime->buffer == NULL) {
@@ -1132,7 +1146,6 @@  int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
 			  "snd_rawmidi_transmit_ack: output is not active!!!\n");
 		return -EINVAL;
 	}
-	spin_lock_irqsave(&runtime->lock, flags);
 	snd_BUG_ON(runtime->avail + count > runtime->buffer_size);
 	runtime->hw_ptr += count;
 	runtime->hw_ptr %= runtime->buffer_size;
@@ -1142,9 +1155,31 @@  int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
 		if (runtime->drain || snd_rawmidi_ready(substream))
 			wake_up(&runtime->sleep);
 	}
-	spin_unlock_irqrestore(&runtime->lock, flags);
 	return count;
 }
+
+/**
+ * snd_rawmidi_transmit_ack - acknowledge the transmission
+ * @substream: the rawmidi substream
+ * @count: the transferred count
+ *
+ * Advances the hardware pointer for the internal output buffer with
+ * the given size and updates the condition.
+ * Call after the transmission is finished.
+ *
+ * Return: The advanced size if successful, or a negative error code on failure.
+ */
+int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
+{
+	struct snd_rawmidi_runtime *runtime = substream->runtime;
+	int result;
+	unsigned long flags;
+
+	spin_lock_irqsave(&runtime->lock, flags);
+	result = __snd_rawmidi_transmit_ack(substream, count);
+	spin_unlock_irqrestore(&runtime->lock, flags);
+	return result;
+}
 EXPORT_SYMBOL(snd_rawmidi_transmit_ack);
 
 /**
@@ -1160,12 +1195,22 @@  EXPORT_SYMBOL(snd_rawmidi_transmit_ack);
 int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
 			 unsigned char *buffer, int count)
 {
+	struct snd_rawmidi_runtime *runtime = substream->runtime;
+	int result;
+	unsigned long flags;
+
+	spin_lock_irqsave(&runtime->lock, flags);
 	if (!substream->opened)
-		return -EBADFD;
-	count = snd_rawmidi_transmit_peek(substream, buffer, count);
-	if (count < 0)
-		return count;
-	return snd_rawmidi_transmit_ack(substream, count);
+		result = -EBADFD;
+	else {
+		count = __snd_rawmidi_transmit_peek(substream, buffer, count);
+		if (count <= 0)
+			result = count;
+		else
+			result = __snd_rawmidi_transmit_ack(substream, count);
+	}
+	spin_unlock_irqrestore(&runtime->lock, flags);
+	return result;
 }
 EXPORT_SYMBOL(snd_rawmidi_transmit);
 
diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
index f71aedfb408c..90186a6cf698 100644
--- a/sound/core/seq/seq_virmidi.c
+++ b/sound/core/seq/seq_virmidi.c
@@ -155,13 +155,17 @@  static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
 	struct snd_virmidi *vmidi = substream->runtime->private_data;
 	int count, res;
 	unsigned char buf[32], *pbuf;
+	unsigned long flags;
 
 	if (up) {
 		vmidi->trigger = 1;
 		if (vmidi->seq_mode == SNDRV_VIRMIDI_SEQ_DISPATCH &&
 		    !(vmidi->rdev->flags & SNDRV_VIRMIDI_SUBSCRIBE)) {
-			snd_rawmidi_transmit_ack(substream, substream->runtime->buffer_size - substream->runtime->avail);
-			return;		/* ignored */
+			while (snd_rawmidi_transmit(substream, buf,
+						    sizeof(buf)) > 0) {
+				/* ignored */
+			}
+			return;
 		}
 		if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
 			if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
@@ -169,7 +173,8 @@  static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
 			vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
 		}
 		while (1) {
-			count = snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
+			spin_lock_irqsave(&substream->runtime->lock, flags);
+			count = __snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
 			if (count <= 0)
 				break;
 			pbuf = buf;
@@ -179,7 +184,7 @@  static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
 					snd_midi_event_reset_encode(vmidi->parser);
 					continue;
 				}
-				snd_rawmidi_transmit_ack(substream, res);
+				__snd_rawmidi_transmit_ack(substream, res);
 				pbuf += res;
 				count -= res;
 				if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
@@ -188,6 +193,7 @@  static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
 					vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
 				}
 			}
+			spin_unlock_irqrestore(&substream->runtime->lock, flags);
 		}
 	} else {
 		vmidi->trigger = 0;