| From ffdd98277f0a1d15a67a74ae09bee713df4c0dbc Mon Sep 17 00:00:00 2001 |
| From: Takashi Iwai <tiwai@suse.de> |
| Date: Fri, 5 Nov 2021 10:15:17 +0100 |
| Subject: ALSA: timer: Unconditionally unlink slave instances, too |
| |
| From: Takashi Iwai <tiwai@suse.de> |
| |
| commit ffdd98277f0a1d15a67a74ae09bee713df4c0dbc upstream. |
| |
| Like the previous fix (commit c0317c0e8709 "ALSA: timer: Fix |
| use-after-free problem"), we have to unlink slave timer instances |
| immediately at snd_timer_stop(), too. Otherwise it may leave a stale |
| entry in the list if the slave instance is freed before actually |
| running. |
| |
| Cc: <stable@vger.kernel.org> |
| Link: https://lore.kernel.org/r/20211105091517.21733-1-tiwai@suse.de |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| sound/core/timer.c | 13 ++++++------- |
| 1 file changed, 6 insertions(+), 7 deletions(-) |
| |
| --- a/sound/core/timer.c |
| +++ b/sound/core/timer.c |
| @@ -636,23 +636,22 @@ static int snd_timer_stop1(struct snd_ti |
| static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop) |
| { |
| unsigned long flags; |
| + bool running; |
| |
| spin_lock_irqsave(&slave_active_lock, flags); |
| - if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) { |
| - spin_unlock_irqrestore(&slave_active_lock, flags); |
| - return -EBUSY; |
| - } |
| + running = timeri->flags & SNDRV_TIMER_IFLG_RUNNING; |
| timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING; |
| if (timeri->timer) { |
| spin_lock(&timeri->timer->lock); |
| list_del_init(&timeri->ack_list); |
| list_del_init(&timeri->active_list); |
| - snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : |
| - SNDRV_TIMER_EVENT_PAUSE); |
| + if (running) |
| + snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : |
| + SNDRV_TIMER_EVENT_PAUSE); |
| spin_unlock(&timeri->timer->lock); |
| } |
| spin_unlock_irqrestore(&slave_active_lock, flags); |
| - return 0; |
| + return running ? 0 : -EBUSY; |
| } |
| |
| /* |
