This is a note to let you know that I've just added the patch titled
ALSA: timer: Fix race between stop and interrupt
to the 4.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
alsa-timer-fix-race-between-stop-and-interrupt.patch
and it can be found in the queue-4.3 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@xxxxxxx>
Date: Tue, 9 Feb 2016 12:02:32 +0100
Subject: ALSA: timer: Fix race between stop and interrupt
From: Takashi Iwai <tiwai@xxxxxxx>
commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.
A slave timer element also unlinks at snd_timer_stop() but it takes
only slave_active_lock. When a slave is assigned to a master,
however, this may become a race against the master's interrupt
handling, eventually resulting in a list corruption. The actual bug
could be seen with a syzkaller fuzzer test case in BugLink below.
As a fix, we need to take timeri->timer->lock when timer isn't NULL,
i.e. assigned to a master, while the assignment to a master itself is
protected by slave_active_lock.
BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@xxxxxxxxxxxxxx
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
sound/core/timer.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -518,9 +518,13 @@ static int _snd_timer_stop(struct snd_ti
spin_unlock_irqrestore(&slave_active_lock, flags);
return -EBUSY;
}
+ if (timeri->timer)
+ spin_lock(&timeri->timer->lock);
timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
list_del_init(&timeri->ack_list);
list_del_init(&timeri->active_list);
+ if (timeri->timer)
+ spin_unlock(&timeri->timer->lock);
spin_unlock_irqrestore(&slave_active_lock, flags);
goto __end;
}
Patches currently in stable-queue which might be from tiwai@xxxxxxx are
queue-4.3/alsa-seq-fix-race-at-closing-in-virmidi-driver.patch
queue-4.3/alsa-hda-fix-bad-dereference-of-jack-object.patch
queue-4.3/c8sectpfe-remove-select-on-config_fw_loader_user_helper_fallback.patch
queue-4.3/alsa-usb-audio-add-quirk-for-microsoft-lifecam-hd-6000.patch
queue-4.3/alsa-rawmidi-remove-kernel-warning-for-null-user-space-buffer-check.patch
queue-4.3/alsa-usb-audio-fix-oppo-ha-1-vendor-id.patch
queue-4.3/alsa-timer-fix-race-at-concurrent-reads.patch
queue-4.3/alsa-hda-fix-static-checker-warning-in-patch_hdmi.c.patch
queue-4.3/alsa-seq-fix-lockdep-warnings-due-to-double-mutex-locks.patch
queue-4.3/alsa-usb-audio-fix-teac-ud-501-ud-503-nt-503-usb-delay.patch
queue-4.3/alsa-timer-fix-wrong-instance-passed-to-slave-callbacks.patch
queue-4.3/alsa-hda-implement-loopback-control-switch-for-realtek-and-other-codecs.patch
queue-4.3/alsa-seq-degrade-the-error-message-for-too-many-opens.patch
queue-4.3/alsa-timer-fix-race-between-stop-and-interrupt.patch
queue-4.3/alsa-compress-disable-get_codec_caps-ioctl-for-some-architectures.patch
queue-4.3/alsa-rawmidi-make-snd_rawmidi_transmit-race-free.patch
queue-4.3/alsa-hda-fix-speaker-output-from-vaio-aio-machines.patch
queue-4.3/alsa-timer-code-cleanup.patch
queue-4.3/alsa-bebob-use-a-signed-return-type-for-get_formation_index.patch
queue-4.3/alsa-dummy-implement-timer-backend-switching-more-safely.patch
queue-4.3/alsa-dummy-disable-switching-timer-backend-via-sysfs.patch
queue-4.3/alsa-seq-fix-incorrect-sanity-check-at-snd_seq_oss_synth_cleanup.patch
queue-4.3/alsa-seq-fix-yet-another-races-among-alsa-timer-accesses.patch
queue-4.3/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch
queue-4.3/revert-alsa-hda-fix-noise-on-gigabyte-z170x-mobo.patch
queue-4.3/alsa-hda-add-fixup-for-mac-mini-7-1-model.patch
queue-4.3/alsa-usb-audio-add-native-dsd-support-for-ps-audio-nuwave-dac.patch
queue-4.3/alsa-timer-fix-leftover-link-at-closing.patch
queue-4.3/alsa-rawmidi-fix-race-at-copying-updating-the-position.patch
queue-4.3/alsa-pcm-fix-potential-deadlock-in-oss-emulation.patch
queue-4.3/alsa-timer-fix-link-corruption-due-to-double-start-or-stop.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html