On Tue, 26 Mar 2019 12:25:37 +0100,
Timo Wischer wrote:
On 3/26/19 09:35, Takashi Iwai wrote:The start may happen at this point.
On Tue, 26 Mar 2019 08:49:33 +0100,
From: Timo Wischer <twischer@xxxxxxxxxxxxxx>
snd_pcm_link() can be called by the user as long as the device is not
yet started. Therefore currently a driver which wants to iterate over
the linked substreams has to do this at the start trigger. But the start
trigger should not block for a long time. Therefore there is no callback
which can be used to iterate over the linked substreams without delaying
the start trigger.
This patch introduces a new callback function which will be called after
the linked substream list was updated by snd_pcm_link(). This callback
function is allowed to block for a longer time without interfering the
synchronized start up of linked substreams.
Signed-off-by: Timo Wischer <twischer@xxxxxxxxxxxxxx>
Well, the idea appears interesting, but I'm afraid that the
implementation is still racy. The place you're calling the new
callback isn't protected, hence the stream can be triggered while
calling it. That is, even during operating your loopback link_changed
callback, another thread is able to start the stream.
As far as I got you mean the following scenario:
* snd_pcm_link() is called for a HW sound card
The attack we are identifying here can only be done by the application opening the aloop device.
+ loopback_snd_timer_open()I don't expect the memory corruption, but my point is that dealing
+ spin_lock_irqsave(&dpcm->cable->lock, flags);
* snd_pcm_start() called for aloop sound card
+ spin_lock(&cable->lock) -> has to wait till loopback_snd_timer_open()
So far snd_pcm_start() has to wait for loopback_snd_timer_open().
* loopback_snd_timer_open() will continue with
+ dpcm->cable->snd_timer.instance = NULL;
* loopback_trigger() can enter the lock
+ loopback_snd_timer_start() will fail with -EINVAL due to
(loopback_trigger == NULL)
At least this will not result into memory corruption due to race or any other
with linked streams is still tricky. It was considered for the
lightweight coupled start/stop operation, and something intensively
depending on the linked status was out of the original design...
But my expectation is that snd_pcm_link(hw, aloop) or snd_pcm_link(aloop, hw)It's not about the actual application usages but rather against the
is only called by the application calling snd_pcm_start(aloop)
because the same aloop device cannot be opened by multiple applications at the
Do you see an use case where one application would call snd_pcm_start() in
parallel with snd_pcm_link() (somehow configuring the device)?
malicious attacks. Especially aloop is a virtual device that is
available allover the places, it may be deployed / attacked easily.
In general when the user uses snd_pcm_link() it expects that the linked devices are somehow synchronized.
May be we should add an additional synchronization mechanism in pcm_native.cIf it really matters... Honestly speaking, I'm not fully convinced
to avoid call of snd_pcm_link() in parallel with snd_pcm_start().
whether we want to deal with this using the PCM link mechanism.
What's the motivation for using the linked streams at the first place?
That's one of the biggest missing piece in the whole picture.