Patch "ALSA: seq: Fix double port list deletion" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

ALSA: seq: Fix double port list deletion

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
alsa-seq-fix-double-port-list-deletion.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Takashi Iwai <[email protected]>
Date: Tue, 16 Feb 2016 14:15:59 +0100
Subject: ALSA: seq: Fix double port list deletion

From: Takashi Iwai <[email protected]>

commit 13d5e5d4725c64ec06040d636832e78453f477b7 upstream.

The commit [7f0973e973cd: ALSA: seq: Fix lockdep warnings due to double mutex locks] split the management of two linked lists (source and destination) into two individual calls for avoiding the AB/BA deadlock. However, this may leave the possible double deletion of one of two lists when the counterpart is being deleted concurrently. It ends up with a list corruption, as revealed by syzkaller fuzzer.

This patch fixes it by checking the list emptiness and skipping the deletion and the following process.

---
 sound/core/seq/seq_ports.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

@@ -535,19 +535,22 @@ static void delete_and_unsubscribe_port(
 					bool is_src, bool ack)
 {
 	struct snd_seq_port_subs_info *grp;
+	struct list_head *list;
+	bool empty;
 
 	grp = is_src ? &port->c_src : &port->c_dest;
+	list = is_src ? &subs->src_list : &subs->dest_list;
 	down_write(&grp->list_mutex);
 	write_lock_irq(&grp->list_lock);
-	if (is_src)
-		list_del(&subs->src_list);
-	else
-		list_del(&subs->dest_list);
+	empty = list_empty(list);
+	if (!empty)
+		list_del_init(list);
 	grp->exclusive = 0;
 	write_unlock_irq(&grp->list_lock);
 	up_write(&grp->list_mutex);
 
-	unsubscribe_port(client, port, grp, &subs->info, ack);
+	if (!empty)
+		unsubscribe_port(client, port, grp, &subs->info, ack);
 }
 
 /* connect two ports */

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/alsa-seq-fix-leak-of-pool-buffer-at-concurrent-writes.patch queue-4.4/alsa-pcm-fix-rwsem-deadlock-for-non-atomic-pcm-stream.patch queue-4.4/alsa-hda-cancel-probe-work-instead-of-flush-at-remove.patch queue-4.4/alsa-seq-fix-double-port-list-deletion.patch