Patch "ALSA: timer: Fix race between stop and interrupt" has been added to the 4.3-stable tree

This is a note to let you know that I've just added the patch titled

ALSA: timer: Fix race between stop and interrupt

to the 4.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
alsa-timer-fix-race-between-stop-and-interrupt.patch
and it can be found in the queue-4.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Takashi Iwai <[email protected]>
Date: Tue, 9 Feb 2016 12:02:32 +0100
Subject: ALSA: timer: Fix race between stop and interrupt

From: Takashi Iwai <[email protected]>

commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.

A slave timer element also unlinks at snd_timer_stop() but it takes only slave_active_lock. When a slave is assigned to a master, however, this may become a race against the master's interrupt handling, eventually resulting in a list corruption. The actual bug could be seen with a syzkaller fuzzer test case in BugLink below.

As a fix, we need to take timeri->timer->lock when timer isn't NULL, i.e. assigned to a master, while the assignment to a master itself is protected by slave_active_lock.

---
 sound/core/timer.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -518,9 +518,13 @@ static int _snd_timer_stop(struct snd_ti
 			spin_unlock_irqrestore(&slave_active_lock, flags);
 			return -EBUSY;
 		}
+		if (timeri->timer)
+			spin_lock(&timeri->timer->lock);
 		timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
 		list_del_init(&timeri->ack_list);
 		list_del_init(&timeri->active_list);
+		if (timeri->timer)
+			spin_unlock(&timeri->timer->lock);
 		spin_unlock_irqrestore(&slave_active_lock, flags);
 		goto __end;
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-4.3/alsa-seq-fix-race-at-closing-in-virmidi-driver.patch queue-4.3/alsa-hda-fix-bad-dereference-of-jack-object.patch queue-4.3/c8sectpfe-remove-select-on-config_fw_loader_user_helper_fallback.patch queue-4.3/alsa-usb-audio-add-quirk-for-microsoft-lifecam-hd-6000.patch queue-4.3/alsa-rawmidi-remove-kernel-warning-for-null-user-space-buffer-check.patch queue-4.3/alsa-usb-audio-fix-oppo-ha-1-vendor-id.patch queue-4.3/alsa-timer-fix-race-at-concurrent-reads.patch queue-4.3/alsa-hda-fix-static-checker-warning-in-patch_hdmi.c.patch queue-4.3/alsa-seq-fix-lockdep-warnings-due-to-double-mutex-locks.patch queue-4.3/alsa-usb-audio-fix-teac-ud-501-ud-503-nt-503-usb-delay.patch queue-4.3/alsa-timer-fix-wrong-instance-passed-to-slave-callbacks.patch queue-4.3/alsa-hda-implement-loopback-control-switch-for-realtek-and-other-codecs.patch queue-4.3/alsa-seq-degrade-the-error-message-for-too-many-opens.patch queue-4.3/alsa-timer-fix-race-between-stop-and-interrupt.patch queue-4.3/alsa-compress-disable-get_codec_caps-ioctl-for-some-architectures.patch queue-4.3/alsa-rawmidi-make-snd_rawmidi_transmit-race-free.patch queue-4.3/alsa-hda-fix-speaker-output-from-vaio-aio-machines.patch queue-4.3/alsa-timer-code-cleanup.patch queue-4.3/alsa-bebob-use-a-signed-return-type-for-get_formation_index.patch queue-4.3/alsa-dummy-implement-timer-backend-switching-more-safely.patch queue-4.3/alsa-dummy-disable-switching-timer-backend-via-sysfs.patch queue-4.3/alsa-seq-fix-incorrect-sanity-check-at-snd_seq_oss_synth_cleanup.patch queue-4.3/alsa-seq-fix-yet-another-races-among-alsa-timer-accesses.patch queue-4.3/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch queue-4.3/revert-alsa-hda-fix-noise-on-gigabyte-z170x-mobo.patch queue-4.3/alsa-hda-add-fixup-for-mac-mini-7-1-model.patch queue-4.3/alsa-usb-audio-add-native-dsd-support-for-ps-audio-nuwave-dac.patch queue-4.3/alsa-timer-fix-leftover-link-at-closing.patch queue-4.3/alsa-rawmidi-fix-race-at-copying-updating-the-position.patch queue-4.3/alsa-pcm-fix-potential-deadlock-in-oss-emulation.patch queue-4.3/alsa-timer-fix-link-corruption-due-to-double-start-or-stop.patch