From: <gregkh@linuxfoundation.org>
To: tiwai@suse.de, gregkh@linuxfoundation.org
Cc: <stable@vger.kernel.org>, <stable-commits@vger.kernel.org>
Subject: Patch "ALSA: timer: Fix race between stop and interrupt" has been added to the 4.4-stable tree
Date: Sun, 14 Feb 2016 12:50:05 -0800 [thread overview]
Message-ID: <145548300519394@kroah.com> (raw)
This is a note to let you know that I've just added the patch titled
ALSA: timer: Fix race between stop and interrupt
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
alsa-timer-fix-race-between-stop-and-interrupt.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 9 Feb 2016 12:02:32 +0100
Subject: ALSA: timer: Fix race between stop and interrupt
From: Takashi Iwai <tiwai@suse.de>
commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.
A slave timer element also unlinks at snd_timer_stop() but it takes
only slave_active_lock. When a slave is assigned to a master,
however, this may become a race against the master's interrupt
handling, eventually resulting in a list corruption. The actual bug
could be seen with a syzkaller fuzzer test case in BugLink below.
As a fix, we need to take timeri->timer->lock when timer isn't NULL,
i.e. assigned to a master, while the assignment to a master itself is
protected by slave_active_lock.
BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/timer.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -518,9 +518,13 @@ static int _snd_timer_stop(struct snd_ti
spin_unlock_irqrestore(&slave_active_lock, flags);
return -EBUSY;
}
+ if (timeri->timer)
+ spin_lock(&timeri->timer->lock);
timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
list_del_init(&timeri->ack_list);
list_del_init(&timeri->active_list);
+ if (timeri->timer)
+ spin_unlock(&timeri->timer->lock);
spin_unlock_irqrestore(&slave_active_lock, flags);
goto __end;
}
Patches currently in stable-queue which might be from tiwai@suse.de are
queue-4.4/alsa-seq-fix-race-at-closing-in-virmidi-driver.patch
queue-4.4/alsa-hda-fix-bad-dereference-of-jack-object.patch
queue-4.4/alsa-usb-audio-add-quirk-for-microsoft-lifecam-hd-6000.patch
queue-4.4/alsa-rawmidi-remove-kernel-warning-for-null-user-space-buffer-check.patch
queue-4.4/alsa-usb-audio-fix-oppo-ha-1-vendor-id.patch
queue-4.4/alsa-timer-fix-race-at-concurrent-reads.patch
queue-4.4/alsa-hda-realtek-support-dell-headset-mode-for-alc225.patch
queue-4.4/alsa-hda-fix-static-checker-warning-in-patch_hdmi.c.patch
queue-4.4/alsa-seq-fix-lockdep-warnings-due-to-double-mutex-locks.patch
queue-4.4/alsa-usb-audio-fix-teac-ud-501-ud-503-nt-503-usb-delay.patch
queue-4.4/alsa-timer-fix-wrong-instance-passed-to-slave-callbacks.patch
queue-4.4/alsa-hda-disable-dynamic-clock-gating-on-broxton-before-reset.patch
queue-4.4/alsa-hda-realtek-support-headset-mode-for-alc225.patch
queue-4.4/alsa-hda-implement-loopback-control-switch-for-realtek-and-other-codecs.patch
queue-4.4/alsa-hda-realtek-new-codec-support-of-alc225.patch
queue-4.4/alsa-seq-degrade-the-error-message-for-too-many-opens.patch
queue-4.4/alsa-timer-fix-race-between-stop-and-interrupt.patch
queue-4.4/alsa-compress-disable-get_codec_caps-ioctl-for-some-architectures.patch
queue-4.4/alsa-rawmidi-make-snd_rawmidi_transmit-race-free.patch
queue-4.4/alsa-hda-fix-speaker-output-from-vaio-aio-machines.patch
queue-4.4/alsa-timer-code-cleanup.patch
queue-4.4/alsa-bebob-use-a-signed-return-type-for-get_formation_index.patch
queue-4.4/alsa-add-missing-dependency-on-config_snd_timer.patch
queue-4.4/alsa-dummy-implement-timer-backend-switching-more-safely.patch
queue-4.4/alsa-dummy-disable-switching-timer-backend-via-sysfs.patch
queue-4.4/alsa-seq-fix-incorrect-sanity-check-at-snd_seq_oss_synth_cleanup.patch
queue-4.4/alsa-seq-fix-yet-another-races-among-alsa-timer-accesses.patch
queue-4.4/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch
queue-4.4/revert-alsa-hda-fix-noise-on-gigabyte-z170x-mobo.patch
queue-4.4/alsa-hda-add-fixup-for-mac-mini-7-1-model.patch
queue-4.4/alsa-usb-audio-add-native-dsd-support-for-ps-audio-nuwave-dac.patch
queue-4.4/alsa-timer-fix-leftover-link-at-closing.patch
queue-4.4/alsa-rawmidi-fix-race-at-copying-updating-the-position.patch
queue-4.4/alsa-pcm-fix-potential-deadlock-in-oss-emulation.patch
queue-4.4/alsa-timer-fix-link-corruption-due-to-double-start-or-stop.patch
reply other threads:[~2016-02-14 20:50 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=145548300519394@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=stable-commits@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox