github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ALSA: timer: drain a slave's callback before its master detaches it

Browse Source 
snd_timer_close_locked() drains the closing instance's own in-flight
callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a
master instance is closed, remove_slave_links() clears each slave's
->timer; the slave's own close then reads timer == NULL and takes the
branch that skips the drain entirely (snd_timer_stop_slave() also no-ops
on a NULL timer). So a slave whose callback is still running when the
master is closed is freed underneath the live callback, leading to
use-after-free.

Drain the slaves too before remove_slave_links() severs them.
snd_timer_stop() has already taken this instance off the active list, so
no new slave callback can be queued. Take the slaves off the ack list so
a pending one can't fire either, then wait for any that is already in
flight.

Fixes: 37745918e0 ("ALSA: timer: Introduce virtual userspace-driven timers")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/D26598EB-DBF7-4D76-9F71-8E4BD59822D4@doyensec.com
This commit is contained in:
Norbert Szetei 2026-07-20 09:14:12 +02:00 committed by Takashi Iwai
parent 70d28bfcd6
commit bdefe1346a
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sound/core/timer.c
View File

@ -489,10 +489,20 @@ static void snd_timer_close_locked(struct snd_timer_instance *timeri,
snd_timer_stop(timeri);
if (timer) {
struct snd_timer_instance *slave;
bool busy;
timer->num_instances--;
/* wait, until the active callback is finished */
/* unqueue then drain the slaves' callbacks before remove_slave_links() severs them */
spin_lock_irq(&timer->lock);
while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) {
list_for_each_entry(slave, &timeri->slave_list_head, open_list)
list_del_init(&slave->ack_list);
for (;;) {
busy = timeri->flags & SNDRV_TIMER_IFLG_CALLBACK;
list_for_each_entry(slave, &timeri->slave_list_head, open_list)
busy |= slave->flags & SNDRV_TIMER_IFLG_CALLBACK;
if (!busy)
break;
spin_unlock_irq(&timer->lock);
udelay(10);
spin_lock_irq(&timer->lock);