Patch "ALSA: timer: Fix race between stop and interrupt" has been added to the 3.14-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    ALSA: timer: Fix race between stop and interrupt

to the 3.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     alsa-timer-fix-race-between-stop-and-interrupt.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.


>From ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@xxxxxxx>
Date: Tue, 9 Feb 2016 12:02:32 +0100
Subject: ALSA: timer: Fix race between stop and interrupt

From: Takashi Iwai <tiwai@xxxxxxx>

commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.

A slave timer element also unlinks at snd_timer_stop() but it takes
only slave_active_lock.  When a slave is assigned to a master,
however, this may become a race against the master's interrupt
handling, eventually resulting in a list corruption.  The actual bug
could be seen with a syzkaller fuzzer test case in BugLink below.

As a fix, we need to take timeri->timer->lock when timer isn't NULL,
i.e. assigned to a master, while the assignment to a master itself is
protected by slave_active_lock.

BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@xxxxxxxxxxxxxx
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

---
 sound/core/timer.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -508,9 +508,13 @@ static int _snd_timer_stop(struct snd_ti
 			spin_unlock_irqrestore(&slave_active_lock, flags);
 			return -EBUSY;
 		}
+		if (timeri->timer)
+			spin_lock(&timeri->timer->lock);
 		timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
 		list_del_init(&timeri->ack_list);
 		list_del_init(&timeri->active_list);
+		if (timeri->timer)
+			spin_unlock(&timeri->timer->lock);
 		spin_unlock_irqrestore(&slave_active_lock, flags);
 		goto __end;
 	}


Patches currently in stable-queue which might be from tiwai@xxxxxxx are

queue-3.14/alsa-seq-fix-race-at-closing-in-virmidi-driver.patch
queue-3.14/alsa-rawmidi-remove-kernel-warning-for-null-user-space-buffer-check.patch
queue-3.14/alsa-hda-fix-static-checker-warning-in-patch_hdmi.c.patch
queue-3.14/alsa-seq-fix-lockdep-warnings-due-to-double-mutex-locks.patch
queue-3.14/alsa-usb-audio-fix-teac-ud-501-ud-503-nt-503-usb-delay.patch
queue-3.14/alsa-timer-fix-wrong-instance-passed-to-slave-callbacks.patch
queue-3.14/alsa-timer-fix-race-between-stop-and-interrupt.patch
queue-3.14/alsa-compress-disable-get_codec_caps-ioctl-for-some-architectures.patch
queue-3.14/alsa-hda-fix-speaker-output-from-vaio-aio-machines.patch
queue-3.14/alsa-timer-code-cleanup.patch
queue-3.14/alsa-dummy-implement-timer-backend-switching-more-safely.patch
queue-3.14/alsa-dummy-disable-switching-timer-backend-via-sysfs.patch
queue-3.14/alsa-seq-fix-incorrect-sanity-check-at-snd_seq_oss_synth_cleanup.patch
queue-3.14/alsa-seq-fix-yet-another-races-among-alsa-timer-accesses.patch
queue-3.14/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch
queue-3.14/alsa-hda-add-fixup-for-mac-mini-7-1-model.patch
queue-3.14/alsa-timer-fix-leftover-link-at-closing.patch
queue-3.14/alsa-rawmidi-fix-race-at-copying-updating-the-position.patch
queue-3.14/alsa-pcm-fix-potential-deadlock-in-oss-emulation.patch
queue-3.14/alsa-timer-fix-link-corruption-due-to-double-start-or-stop.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]