android_kernel_google_msm/sound
Takashi Iwai 8e830ee882 UPSTREAM: ALSA: timer: Fix race between stop and interrupt
commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.

A slave timer element also unlinks at snd_timer_stop() but it takes
only slave_active_lock.  When a slave is assigned to a master,
however, this may become a race against the master's interrupt
handling, eventually resulting in a list corruption.  The actual bug
could be seen with a syzkaller fuzzer test case in BugLink below.

As a fix, we need to take timeri->timer->lock when timer isn't NULL,
i.e. assigned to a master, while the assignment to a master itself is
protected by slave_active_lock.

Bug: 37240993
Change-Id: Ib6eae144d5fdc92546d2210bcd6bc56454ad3e42
BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Siqi Lin <siqilin@google.com>
2018-01-13 17:13:37 +03:00
..
aoa
arm ASoC: fix broken pxa SoC support 2016-04-27 18:55:20 +08:00
atmel
compress_offload
core UPSTREAM: ALSA: timer: Fix race between stop and interrupt 2018-01-13 17:13:37 +03:00
drivers
firewire
i2c ALSA: ak411x: Fix stall in work callback 2015-04-14 17:33:59 +08:00
isa
mips
oss
parisc
pci ALSA: rme96: Fix unexpected volume reset after rate changes 2016-10-26 23:15:35 +08:00
pcmcia
ppc
sh
soc Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1 2017-12-27 17:13:15 +03:00
sparc
spi
synth ALSA: synth: Fix conflicting OSS device registration on AWE32 2016-04-27 18:55:27 +08:00
usb Merge remote-tracking branch 'stable/linux-3.4.y' into lineage-15.1 2017-12-27 17:13:15 +03:00
ac97_bus.c
Kconfig
last.c
Makefile
sound_core.c
sound_firmware.c