Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1341075
| From | Ben Hutchings <ben@decadent.org.uk> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.2 56/67] ALSA: timer: Fix race between stop and interrupt |
| Date | 2016-02-23 23:00 +0100 |
| Message-ID | <r5t9U-2Zj-17@gated-at.bofh.it> (permalink) |
| References | <r5t0e-2Ub-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.2.78-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Takashi Iwai <tiwai@suse.de> commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream. A slave timer element also unlinks at snd_timer_stop() but it takes only slave_active_lock. When a slave is assigned to a master, however, this may become a race against the master's interrupt handling, eventually resulting in a list corruption. The actual bug could be seen with a syzkaller fuzzer test case in BugLink below. As a fix, we need to take timeri->timer->lock when timer isn't NULL, i.e. assigned to a master, while the assignment to a master itself is protected by slave_active_lock. BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de> [bwh: Backported to 3.2: adjust context, indentation] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> --- sound/core/timer.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -510,9 +510,13 @@ static int _snd_timer_stop(struct snd_ti spin_unlock_irqrestore(&slave_active_lock, flags); return -EBUSY; } + if (timeri->timer) + spin_lock(&timeri->timer->lock); timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING; list_del_init(&timeri->ack_list); list_del_init(&timeri->active_list); + if (timeri->timer) + spin_unlock(&timeri->timer->lock); spin_unlock_irqrestore(&slave_active_lock, flags); } goto __end;
Back to linux.kernel | Previous | Next | Find similar | Unroll thread
[PATCH 3.2 56/67] ALSA: timer: Fix race between stop and interrupt Ben Hutchings <ben@decadent.org.uk> - 2016-02-23 23:00 +0100
csiph-web