mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* [PATCH] ALSA: mixer: oss: Serialize initial slot construction
@ 2026-10-15 17:11 Cen Zhang
  2026-10-15 19:53 ` Takashi Iwai
  0 siblings, 1 reply; 2+ messages in thread
From: Cen Zhang @ 2026-10-15 17:11 UTC (permalink / raw)
  To: perex, tiwai, phucduc.bui, cezary.rojewski, kees+treewide, error27
  Cc: linux-sound, linux-kernel, baijiaju1990, jjzuming, zzzccc427

OSS mixer slot callbacks require an initialized private_data payload.
However, snd_mixer_oss_notify_handler() publishes card->mixer_oss before
snd_mixer_oss_build() constructs the default bindings, and
snd_mixer_oss_build_input() stores get_volume before private_data.

With OSS mixer emulation enabled and a native control matching a default
mapping, a volume read can arrive during initial binding construction.
For example, the dummy card provides the Master Volume control before
registration. The following ordering lets the read use the callback
before its payload is attached:

    Card registration                    OSS volume read
    -----------------                    ---------------
    register the OSS mixer device
    publish card->mixer_oss
    store slot->get_volume
                                         open the mixer device
                                         lock reg_mutex
                                         invoke slot->get_volume
                                         load NULL private_data
                                         read slot->present
    store slot->private_data

The read holds reg_mutex, but the initial builder does not acquire it.
The controls_rwsem read lock protects native controls and does not
serialize the builder with another reader. As a result,
snd_mixer_oss_get_volume1() can dereference a NULL payload and Oops.

Hold the existing reg_mutex throughout snd_mixer_oss_build(), as proc
remapping already does for snd_mixer_oss_build_input(). A request can no
longer invoke a callback between its installation and the payload store.
This keeps the existing reg_mutex-before-controls_rwsem lock order.

KASAN report as below:

    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
    KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
    CPU: 1 UID: 0 PID: 431 Comm: alsa-oss-trigge Tainted: G           O        7.2.0-rc6-pmb-bt-functional-v1+ #1 PREEMPT(lazy)
    Tainted: [O]=OOT_MODULE
    Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    RIP: 0010:snd_mixer_oss_get_volume1+0xd1/0x610 [snd_mixer_oss]
    Code: 00 c7 03 64 00 00 00 e9 b8 01 00 00 e8 e8 82 44 c1 49 8d 75 04 48 b8 00 00 00 00 00 fc ff df 48 89 f2 48 89 34 24 48 c1 ea 03 <0f> b6 14 02 48 89 f0 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 3f
    RSP: 0018:ffff888104c67cc8 EFLAGS: 00010257
    RAX: dffffc0000000000 RBX: ffff888104c67d80 RCX: ffffffffc0406cb8
    RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff862d93a4
    RBP: ffff888104c67d90 R08: 0000000000000001 R09: 0000000000000001
    R10: ffffffff89406e57 R11: ffff888104c9d700 R12: ffff888113c48038
    R13: 0000000000000000 R14: ffff888113c48000 R15: ffff888104646820
    FS:  00007f7904d29780(0000) GS:ffff8881fd81d000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f7904e388e0 CR3: 000000010662c002 CR4: 0000000000770ef0
    PKRU: 55555554
    Call Trace:
     <TASK>
     snd_mixer_oss_ioctl1+0x25d/0x16f0 [snd_mixer_oss]
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_snd_mixer_oss_get_volume1+0x10/0x10 [snd_mixer_oss]
     ? __pfx_snd_mixer_oss_ioctl1+0x10/0x10 [snd_mixer_oss]
     ? lock_release+0xc8/0x280
     ? pmbd_site_is_armed+0xa1/0xd0
     ? lockdep_hardirqs_on_prepare+0xea/0x1a0
     ? trace_hardirqs_on+0x18/0x160
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? _raw_spin_unlock_irqrestore+0x44/0x60
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? pmbd_gate_site_armed+0x31/0x1c0
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? pmbd_probe_hit_cookie+0xee/0x1c0
     ? __pfx_pmbd_probe_hit_cookie+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? selinux_file_ioctl+0xaa/0x280
     snd_mixer_oss_ioctl+0x4a/0x80 [snd_mixer_oss]
     ? __pfx_snd_mixer_oss_ioctl+0x10/0x10 [snd_mixer_oss]
     __x64_sys_ioctl+0x163/0x1d0
     do_syscall_64+0x115/0x6a0
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7f7904e3891b
    Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
    RSP: 002b:00007ffc72071e20 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
    RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7904e3891b
    RDX: 00007ffc72071e84 RSI: 0000000080044d00 RDI: 0000000000000003
    RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc72072e12
    R13: 00007ffc72072060 R14: 00007f7904f67000 R15: 000055cd1e601d50
     </TASK>
    Modules linked in: snd_dummy(O) snd_mixer_oss(O)
    ---[ end trace 0000000000000000 ]---
    RIP: 0010:snd_mixer_oss_get_volume1+0xd1/0x610 [snd_mixer_oss]
    Code: 00 c7 03 64 00 00 00 e9 b8 01 00 00 e8 e8 82 44 c1 49 8d 75 04 48 b8 00 00 00 00 00 fc ff df 48 89 f2 48 89 34 24 48 c1 ea 03 <0f> b6 14 02 48 89 f0 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 3f
    RSP: 0018:ffff888104c67cc8 EFLAGS: 00010257
    RAX: dffffc0000000000 RBX: ffff888104c67d80 RCX: ffffffffc0406cb8
    RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff862d93a4
    RBP: ffff888104c67d90 R08: 0000000000000001 R09: 0000000000000001
    R10: ffffffff89406e57 R11: ffff888104c9d700 R12: ffff888113c48038
    R13: 0000000000000000 R14: ffff888113c48000 R15: ffff888104646820
    FS:  00007f7904d29780(0000) GS:ffff8881fd81d000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f7904e388e0 CR3: 000000010662c002 CR4: 0000000000770ef0
    PKRU: 55555554
    Kernel panic - not syncing: Fatal exception
    Kernel Offset: disabled
    Rebooting in 1 seconds..

Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---

diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index c533d767c29ac0d2099936f0d4af71a12f082769..f1fa42e634fc145b734551c0957f9c2fa9745383 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -1272,6 +1272,7 @@ static void snd_mixer_oss_build(struct snd_mixer_oss *mixer)
 	};
 	unsigned int idx;
 	
+	guard(mutex)(&mixer->reg_mutex);
 	for (idx = 0; idx < ARRAY_SIZE(table); idx++)
 		snd_mixer_oss_build_input(mixer, &table[idx], 0, 0);
 	if (mixer->mask_recsrc) {

^ permalink raw reply	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-15 19:53 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-15 17:11 [PATCH] ALSA: mixer: oss: Serialize initial slot construction Cen Zhang
2026-10-15 19:53 ` Takashi Iwai

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®