This is a note to let you know that I've just added the patch titled
ALSA: timer: Fix race between stop and interrupt
to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
alsa-timer-fix-race-between-stop-and-interrupt.patch
and it can be found in the queue-3.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@xxxxxxx>
Date: Tue, 9 Feb 2016 12:02:32 +0100
Subject: ALSA: timer: Fix race between stop and interrupt
From: Takashi Iwai <tiwai@xxxxxxx>
commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.
A slave timer element also unlinks at snd_timer_stop() but it takes
only slave_active_lock. When a slave is assigned to a master,
however, this may become a race against the master's interrupt
handling, eventually resulting in a list corruption. The actual bug
could be seen with a syzkaller fuzzer test case in BugLink below.
As a fix, we need to take timeri->timer->lock when timer isn't NULL,
i.e. assigned to a master, while the assignment to a master itself is
protected by slave_active_lock.
BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@xxxxxxxxxxxxxx
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
sound/core/timer.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -508,9 +508,13 @@ static int _snd_timer_stop(struct snd_ti
spin_unlock_irqrestore(&slave_active_lock, flags);
return -EBUSY;
}
+ if (timeri->timer)
+ spin_lock(&timeri->timer->lock);
timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
list_del_init(&timeri->ack_list);
list_del_init(&timeri->active_list);
+ if (timeri->timer)
+ spin_unlock(&timeri->timer->lock);
spin_unlock_irqrestore(&slave_active_lock, flags);
goto __end;
}
Patches currently in stable-queue which might be from tiwai@xxxxxxx are
queue-3.10/alsa-seq-fix-race-at-closing-in-virmidi-driver.patch
queue-3.10/alsa-rawmidi-remove-kernel-warning-for-null-user-space-buffer-check.patch
queue-3.10/alsa-seq-fix-lockdep-warnings-due-to-double-mutex-locks.patch
queue-3.10/alsa-usb-audio-fix-teac-ud-501-ud-503-nt-503-usb-delay.patch
queue-3.10/alsa-timer-fix-wrong-instance-passed-to-slave-callbacks.patch
queue-3.10/alsa-timer-fix-race-between-stop-and-interrupt.patch
queue-3.10/alsa-compress-disable-get_codec_caps-ioctl-for-some-architectures.patch
queue-3.10/alsa-hda-fix-speaker-output-from-vaio-aio-machines.patch
queue-3.10/alsa-timer-code-cleanup.patch
queue-3.10/alsa-dummy-implement-timer-backend-switching-more-safely.patch
queue-3.10/alsa-dummy-disable-switching-timer-backend-via-sysfs.patch
queue-3.10/alsa-seq-fix-incorrect-sanity-check-at-snd_seq_oss_synth_cleanup.patch
queue-3.10/alsa-seq-fix-yet-another-races-among-alsa-timer-accesses.patch
queue-3.10/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch
queue-3.10/alsa-timer-fix-leftover-link-at-closing.patch
queue-3.10/alsa-rawmidi-fix-race-at-copying-updating-the-position.patch
queue-3.10/alsa-pcm-fix-potential-deadlock-in-oss-emulation.patch
queue-3.10/alsa-timer-fix-link-corruption-due-to-double-start-or-stop.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html