lkml.org 
[lkml]   [2021]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 016/162] ALSA: timer: Unconditionally unlink slave instances, too
    Date
    From: Takashi Iwai <tiwai@suse.de>

    commit ffdd98277f0a1d15a67a74ae09bee713df4c0dbc upstream.

    Like the previous fix (commit c0317c0e8709 "ALSA: timer: Fix
    use-after-free problem"), we have to unlink slave timer instances
    immediately at snd_timer_stop(), too. Otherwise it may leave a stale
    entry in the list if the slave instance is freed before actually
    running.

    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20211105091517.21733-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    sound/core/timer.c | 13 ++++++-------
    1 file changed, 6 insertions(+), 7 deletions(-)

    --- a/sound/core/timer.c
    +++ b/sound/core/timer.c
    @@ -566,23 +566,22 @@ static int snd_timer_stop1(struct snd_ti
    static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop)
    {
    unsigned long flags;
    + bool running;

    spin_lock_irqsave(&slave_active_lock, flags);
    - if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) {
    - spin_unlock_irqrestore(&slave_active_lock, flags);
    - return -EBUSY;
    - }
    + running = timeri->flags & SNDRV_TIMER_IFLG_RUNNING;
    timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
    if (timeri->timer) {
    spin_lock(&timeri->timer->lock);
    list_del_init(&timeri->ack_list);
    list_del_init(&timeri->active_list);
    - snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
    - SNDRV_TIMER_EVENT_PAUSE);
    + if (running)
    + snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
    + SNDRV_TIMER_EVENT_PAUSE);
    spin_unlock(&timeri->timer->lock);
    }
    spin_unlock_irqrestore(&slave_active_lock, flags);
    - return 0;
    + return running ? 0 : -EBUSY;
    }

    /*

    \
     
     \ /
      Last update: 2021-11-24 13:04    [W:3.067 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site