This is a note to let you know that I've just added the patch titled
ALSA: timer: Fix leftover link at closing
to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
alsa-timer-fix-leftover-link-at-closing.patch
and it can be found in the queue-3.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 094fd3be87b0f102589e2d5c3fa5d06b7e20496d Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@xxxxxxx>
Date: Thu, 4 Feb 2016 17:06:13 +0100
Subject: ALSA: timer: Fix leftover link at closing
From: Takashi Iwai <tiwai@xxxxxxx>
commit 094fd3be87b0f102589e2d5c3fa5d06b7e20496d upstream.
In ALSA timer core, the active timer instance is managed in
active_list linked list. Each element is added / removed dynamically
at timer start, stop and in timer interrupt. The problem is that
snd_timer_interrupt() has a thinko and leaves the element in
active_list when it's the last opened element. This eventually leads
to list corruption or use-after-free error.
This hasn't been revealed because we used to delete the list forcibly
in snd_timer_stop() in the past. However, the recent fix avoids the
double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link
corruption due to double start or stop]), and this leak hits reality.
This patch fixes the link management in snd_timer_interrupt(). Now it
simply unlinks no matter which stream is.
BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@xxxxxxxxxxxxxx
Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
sound/core/timer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -702,8 +702,8 @@ void snd_timer_interrupt(struct snd_time
ti->cticks = ti->ticks;
} else {
ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
- if (--timer->running)
- list_del_init(&ti->active_list);
+ --timer->running;
+ list_del_init(&ti->active_list);
}
if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) ||
(ti->flags & SNDRV_TIMER_IFLG_FAST))
Patches currently in stable-queue which might be from tiwai@xxxxxxx are
queue-3.10/alsa-seq-fix-race-at-closing-in-virmidi-driver.patch
queue-3.10/alsa-rawmidi-remove-kernel-warning-for-null-user-space-buffer-check.patch
queue-3.10/alsa-seq-fix-lockdep-warnings-due-to-double-mutex-locks.patch
queue-3.10/alsa-usb-audio-fix-teac-ud-501-ud-503-nt-503-usb-delay.patch
queue-3.10/alsa-timer-fix-wrong-instance-passed-to-slave-callbacks.patch
queue-3.10/alsa-compress-disable-get_codec_caps-ioctl-for-some-architectures.patch
queue-3.10/alsa-hda-fix-speaker-output-from-vaio-aio-machines.patch
queue-3.10/alsa-dummy-implement-timer-backend-switching-more-safely.patch
queue-3.10/alsa-dummy-disable-switching-timer-backend-via-sysfs.patch
queue-3.10/alsa-seq-fix-incorrect-sanity-check-at-snd_seq_oss_synth_cleanup.patch
queue-3.10/alsa-seq-fix-yet-another-races-among-alsa-timer-accesses.patch
queue-3.10/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch
queue-3.10/alsa-timer-fix-leftover-link-at-closing.patch
queue-3.10/alsa-rawmidi-fix-race-at-copying-updating-the-position.patch
queue-3.10/alsa-pcm-fix-potential-deadlock-in-oss-emulation.patch
queue-3.10/alsa-timer-fix-link-corruption-due-to-double-start-or-stop.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html