FAILED: patch "[PATCH] ALSA: timer: Fix race between stop and interrupt" failed to apply to 4.4-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
Quoted 1 line
From
ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51Mon Sep 17 00:00:00 2001
From: Takashi Iwai <[email protected]>
Date: Tue, 9 Feb 2016 12:02:32 +0100
Subject: [PATCH] ALSA: timer: Fix race between stop and interrupt
A slave timer element also unlinks at snd_timer_stop() but it takes only slave_active_lock. When a slave is assigned to a master, however, this may become a race against the master's interrupt handling, eventually resulting in a list corruption. The actual bug could be seen with a syzkaller fuzzer test case in BugLink below.
As a fix, we need to take timeri->timer->lock when timer isn't NULL, i.e. assigned to a master, while the assignment to a master itself is protected by slave_active_lock.
sound/core/timer.c +4 -0
@@ -518,9 +518,13 @@ static int _snd_timer_stop(struct snd_timer_instance *timeri, int event)spin_unlock_irqrestore (&slave_active_lock, flags);return -EBUSY ; } +if (timeri->timer) +spin_lock (&timeri->timer->lock); timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ;list_del_init (&timeri->ack_list);list_del_init (&timeri->active_list); +if (timeri->timer) +spin_unlock (&timeri->timer->lock);spin_unlock_irqrestore (&slave_active_lock, flags); goto __end; }
Quoted 6 lines · On Sun, 14 Feb 2016 20:25:55 +0100, <[email protected]> wrote:
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
There is a prerequisite change by the commitc3b1681375dc6e71d89a3ae00cc3ce9e775a8917
ALSA: timer: Code cleanup
Could you cherry-pick it beforehand?
thanks,
Takashi
Quoted 45 lines
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
Quoted 1 line
From
ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51Mon Sep 17 00:00:00 2001From: Takashi Iwai <[email protected]>
Date: Tue, 9 Feb 2016 12:02:32 +0100
Subject: [PATCH] ALSA: timer: Fix race between stop and interruptA slave timer element also unlinks at
snd_timer_stop()but it takes onlyslave_active_lock. When a slave is assigned to a master, however, this may become a race against the master's interrupt handling, eventually resulting in a list corruption. The actual bug could be seen with a syzkaller fuzzer test case in BugLink below.As a fix, we need to take
timeri->timer->lockwhen timer isn't NULL, i.e. assigned to a master, while the assignment to a master itself is protected byslave_active_lock.BugLink http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com open hereCc <[email protected]>Signed-off-by Takashi Iwai <[email protected]>sound/core/timer.c +4
-0@@ -518,9 +518,13 @@ static int _snd_timer_stop(struct snd_timer_instance *timeri, int event)spin_unlock_irqrestore (&slave_active_lock, flags);return -EBUSY ; } +if (timeri->timer) +spin_lock (&timeri->timer->lock); timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ;list_del_init (&timeri->ack_list);list_del_init (&timeri->active_list); +if (timeri->timer) +spin_unlock (&timeri->timer->lock);spin_unlock_irqrestore (&slave_active_lock, flags); goto __end; }
Greg KH
maintainerQuoted 9 lines · Takashi Iwai
Quoted 6 lines · On Sun, 14 Feb 2016 20:25:55 +0100, <[email protected]> wrote:
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
Quoted 5 lines
There is a prerequisite change by the commit
c3b1681375dc6e71d89a3ae00cc3ce9e775a8917
ALSA: timer: Code cleanupCould you cherry-pick it beforehand?
Ah, that makes sense, I had to hand-fix-up some other patches in this series because I missed that one. I'll add this, and then fix those others as well, and add this one, thanks.
greg k-h