Patch "ALSA: dummy: Disable switching timer backend via sysfs" has been added to the 3.10-stable tree

Patch "ALSA: dummy: Disable switching timer backend via sysfs" has been added to the 3.10-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    ALSA: dummy: Disable switching timer backend via sysfs

to the 3.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     alsa-dummy-disable-switching-timer-backend-via-sysfs.patch
and it can be found in the queue-3.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 7ee96216c31aabe1eb42fb91ff50dae9fcd014b2 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 28 Jan 2016 07:54:16 +0100
Subject: ALSA: dummy: Disable switching timer backend via sysfs

From: Takashi Iwai <tiwai@suse.de>

commit 7ee96216c31aabe1eb42fb91ff50dae9fcd014b2 upstream.

ALSA dummy driver can switch the timer backend between system timer
and hrtimer via its hrtimer module option.  This can be also switched
dynamically via sysfs, but it may lead to a memory corruption when
switching is done while a PCM stream is running; the stream instance
for the newly switched timer method tries to access the memory that
was allocated by another timer method although the sizes differ.

As the simplest fix, this patch just disables the switch via sysfs by
dropping the writable bit.

BugLink: http://lkml.kernel.org/r/CACT4Y+ZGEeEBntHW5WHn2GoeE0G_kRrCmUh6=dWyy-wfzvuJLg@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/drivers/dummy.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/drivers/dummy.c
+++ b/sound/drivers/dummy.c
@@ -87,7 +87,7 @@ MODULE_PARM_DESC(pcm_substreams, "PCM su
 module_param(fake_buffer, bool, 0444);
 MODULE_PARM_DESC(fake_buffer, "Fake buffer allocations.");
 #ifdef CONFIG_HIGH_RES_TIMERS
-module_param(hrtimer, bool, 0644);
+module_param(hrtimer, bool, 0444);
 MODULE_PARM_DESC(hrtimer, "Use hrtimer as the timer source.");
 #endif
 


Patches currently in stable-queue which might be from tiwai@suse.de are

queue-3.10/alsa-seq-fix-race-at-closing-in-virmidi-driver.patch
queue-3.10/alsa-rawmidi-remove-kernel-warning-for-null-user-space-buffer-check.patch
queue-3.10/alsa-seq-fix-lockdep-warnings-due-to-double-mutex-locks.patch
queue-3.10/alsa-usb-audio-fix-teac-ud-501-ud-503-nt-503-usb-delay.patch
queue-3.10/alsa-timer-fix-wrong-instance-passed-to-slave-callbacks.patch
queue-3.10/alsa-compress-disable-get_codec_caps-ioctl-for-some-architectures.patch
queue-3.10/alsa-hda-fix-speaker-output-from-vaio-aio-machines.patch
queue-3.10/alsa-dummy-implement-timer-backend-switching-more-safely.patch
queue-3.10/alsa-dummy-disable-switching-timer-backend-via-sysfs.patch
queue-3.10/alsa-seq-fix-incorrect-sanity-check-at-snd_seq_oss_synth_cleanup.patch
queue-3.10/alsa-seq-fix-yet-another-races-among-alsa-timer-accesses.patch
queue-3.10/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch
queue-3.10/alsa-timer-fix-leftover-link-at-closing.patch
queue-3.10/alsa-rawmidi-fix-race-at-copying-updating-the-position.patch
queue-3.10/alsa-pcm-fix-potential-deadlock-in-oss-emulation.patch
queue-3.10/alsa-timer-fix-link-corruption-due-to-double-start-or-stop.patch