Commit 094fd3be authored Feb 04, 2016 by Takashi Iwai

ALSA: timer: Fix leftover link at closing

In ALSA timer core, the active timer instance is managed in
active_list linked list.  Each element is added / removed dynamically
at timer start, stop and in timer interrupt.  The problem is that
snd_timer_interrupt() has a thinko and leaves the element in
active_list when it's the last opened element.  This eventually leads
to list corruption or use-after-free error.

This hasn't been revealed because we used to delete the list forcibly
in snd_timer_stop() in the past.  However, the recent fix avoids the
double-stop behavior (in commit [f784beb7: ALSA: timer: Fix link
corruption due to double start or stop]), and this leak hits reality.

This patch fixes the link management in snd_timer_interrupt().  Now it
simply unlinks no matter which stream is.

BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@mail.gmail.com


Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

parent 2e5dc73f

sound/core/timer.c

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -744,7 +744,7 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
	ti->cticks = ti->ticks;		ti->cticks = ti->ticks;
	} else {		} else {
	ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING;		ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
	if (--timer->running)		--timer->running;
	list_del_init(&ti->active_list);		list_del_init(&ti->active_list);
	}		}
	if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) \|\|		if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) \|\|

Admin message