[PATCH 3.2 53/67] ALSA: timer: Fix wrong instance passed to slave callbacks

Path	csiph.com!aioe.org!bofh.it!news.nic.it!robomod
From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.kernel
Subject	[PATCH 3.2 53/67] ALSA: timer: Fix wrong instance passed to slave callbacks
Date	Tue, 23 Feb 2016 22:50:03 +0100
Message-ID	<r5t0f-2Ub-11@gated-at.bofh.it> (permalink)
References	<r5t0e-2Ub-3@gated-at.bofh.it>
X-Original-To	linux-kernel@vger.kernel.org, stable@vger.kernel.org
Content-Type	text/plain; charset="UTF-8"
Content-Disposition	inline
Content-Transfer-Encoding	8bit
MIME-Version	1.0
X-Mailer	LinuxStableQueue (scripts by bwh)
X-Sa-Exim-Connect-IP	92.40.248.141
X-Sa-Exim-Mail-From	ben@decadent.org.uk
X-Sa-Exim-Scanned	No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	34
Organization	linux.* mail to news gateway
X-Original-Cc	akpm@linux-foundation.org, "Dmitry Vyukov" <dvyukov@google.com>, "Takashi Iwai" <tiwai@suse.de>
X-Original-Date	Tue, 23 Feb 2016 21:42:03 +0000
X-Original-Message-ID	<lsq.1456263723.59241880@decadent.org.uk>
X-Original-References	<lsq.1456263722.390955919@decadent.org.uk>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1341049

Show key headers only | View raw

3.2.78-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 117159f0b9d392fb433a7871426fad50317f06f7 upstream.

In snd_timer_notify1(), the wrong timer instance was passed for slave
ccallback function.  This leads to the access to the wrong data when
an incompatible master is handled (e.g. the master is the sequencer
timer and the slave is a user timer), as spotted by syzkaller fuzzer.

This patch fixes that wrong assignment.

BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 sound/core/timer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -414,7 +414,7 @@ static void snd_timer_notify1(struct snd
 	spin_lock_irqsave(&timer->lock, flags);
 	list_for_each_entry(ts, &ti->slave_active_head, active_list)
 		if (ts->ccallback)
-			ts->ccallback(ti, event + 100, &tstamp, resolution);
+			ts->ccallback(ts, event + 100, &tstamp, resolution);
 	spin_unlock_irqrestore(&timer->lock, flags);
 }

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 3.2 53/67] ALSA: timer: Fix wrong instance passed to slave  callbacks Ben Hutchings <ben@decadent.org.uk> - 2016-02-23 22:50 +0100

csiph-web