Patch "ALSA: timer: Fix leftover link at closing" has been added to the 4.4-stable tree
Subsystems (2)
This is a note to let you know that I've just added the patch titled
ALSA: timer: Fix leftover link at closing
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
alsa-timer-fix-leftover-link-at-closing.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
094fd3be87b0f102589e2d5c3fa5d06b7e20496dMon Sep 17 00:00:00 2001
From: Takashi Iwai <[email protected]>
Date: Thu, 4 Feb 2016 17:06:13 +0100
Subject: ALSA: timer: Fix leftover link at closing
From: Takashi Iwai <[email protected]>
commit 094fd3be87b0f102589e2d5c3fa5d06b7e20496d upstream.
In ALSA timer core, the active timer instance is managed in active_list linked list. Each element is added / removed dynamically at timer start, stop and in timer interrupt. The problem is that snd_timer_interrupt() has a thinko and leaves the element in active_list when it's the last opened element. This eventually leads to list corruption or use-after-free error.
This hasn't been revealed because we used to delete the list forcibly in snd_timer_stop() in the past. However, the recent fix avoids the double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link corruption due to double start or stop]), and this leak hits reality.
This patch fixes the link management in snd_timer_interrupt(). Now it simply unlinks no matter which stream is.
--- sound/core/timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/timer.c +2 -2
@@ -724,8 +724,8 @@ void snd_timer_interrupt(struct snd_time ti->cticks = ti->ticks; }else { ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING ; -if (--timer->running) -list_del_init (&ti->active_list); + --timer->running; +list_del_init (&ti->active_list); }if ((timer->hw.flags &SNDRV_TIMER_HW_TASKLET ) || (ti->flags &SNDRV_TIMER_IFLG_FAST ))
Patches currently in stable-queue which might be from [email protected] are
queue-4.4/alsa-seq-fix-race-at-closing-in-virmidi-driver.patch queue-4.4/alsa-hda-fix-bad-dereference-of-jack-object.patch queue-4.4/alsa-usb-audio-add-quirk-for-microsoft-lifecam-hd-6000.patch queue-4.4/alsa-rawmidi-remove-kernel-warning-for-null-user-space-buffer-check.patch queue-4.4/alsa-usb-audio-fix-oppo-ha-1-vendor-id.patch queue-4.4/alsa-timer-fix-race-at-concurrent-reads.patch queue-4.4/alsa-hda-realtek-support-dell-headset-mode-for-alc225.patch queue-4.4/alsa-hda-fix-static-checker-warning-in-patch_hdmi.c.patch queue-4.4/alsa-seq-fix-lockdep-warnings-due-to-double-mutex-locks.patch queue-4.4/alsa-usb-audio-fix-teac-ud-501-ud-503-nt-503-usb-delay.patch queue-4.4/alsa-timer-fix-wrong-instance-passed-to-slave-callbacks.patch queue-4.4/alsa-hda-disable-dynamic-clock-gating-on-broxton-before-reset.patch queue-4.4/alsa-hda-realtek-support-headset-mode-for-alc225.patch queue-4.4/alsa-hda-implement-loopback-control-switch-for-realtek-and-other-codecs.patch queue-4.4/alsa-hda-realtek-new-codec-support-of-alc225.patch queue-4.4/alsa-seq-degrade-the-error-message-for-too-many-opens.patch queue-4.4/alsa-compress-disable-get_codec_caps-ioctl-for-some-architectures.patch queue-4.4/alsa-rawmidi-make-snd_rawmidi_transmit-race-free.patch queue-4.4/alsa-hda-fix-speaker-output-from-vaio-aio-machines.patch queue-4.4/alsa-bebob-use-a-signed-return-type-for-get_formation_index.patch queue-4.4/alsa-add-missing-dependency-on-config_snd_timer.patch queue-4.4/alsa-dummy-implement-timer-backend-switching-more-safely.patch queue-4.4/alsa-dummy-disable-switching-timer-backend-via-sysfs.patch queue-4.4/alsa-seq-fix-incorrect-sanity-check-at-snd_seq_oss_synth_cleanup.patch queue-4.4/alsa-seq-fix-yet-another-races-among-alsa-timer-accesses.patch queue-4.4/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch queue-4.4/revert-alsa-hda-fix-noise-on-gigabyte-z170x-mobo.patch queue-4.4/alsa-hda-add-fixup-for-mac-mini-7-1-model.patch queue-4.4/alsa-usb-audio-add-native-dsd-support-for-ps-audio-nuwave-dac.patch queue-4.4/alsa-timer-fix-leftover-link-at-closing.patch queue-4.4/alsa-rawmidi-fix-race-at-copying-updating-the-position.patch queue-4.4/alsa-pcm-fix-potential-deadlock-in-oss-emulation.patch queue-4.4/alsa-timer-fix-link-corruption-due-to-double-start-or-stop.patch