github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
3ca485a067
linux/sound/core
History
Norbert Szetei bdefe1346a ALSA: timer: drain a slave's callback before its master detaches it 
snd_timer_close_locked() drains the closing instance's own in-flight
callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a
master instance is closed, remove_slave_links() clears each slave's
->timer; the slave's own close then reads timer == NULL and takes the
branch that skips the drain entirely (snd_timer_stop_slave() also no-ops
on a NULL timer). So a slave whose callback is still running when the
master is closed is freed underneath the live callback, leading to
use-after-free.

Drain the slaves too before remove_slave_links() severs them.
snd_timer_stop() has already taken this instance off the active list, so
no new slave callback can be queued. Take the slaves off the ack list so
a pending one can't fire either, then wait for any that is already in
flight.

Fixes: 37745918e0 ("ALSA: timer: Introduce virtual userspace-driven timers")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/D26598EB-DBF7-4D76-9F71-8E4BD59822D4@doyensec.com
2026-07-20 10:16:56 +02:00
..
oss ALSA: core: Mark some variables as __ro_after_init 2026-05-25 09:31:40 +02:00
seq ALSA: seq: close a re-opened queue timer in the destructor 2026-07-14 11:08:59 +02:00
.kunitconfig ALSA: core: add kunitconfig 2024-03-17 09:36:45 +01:00
compress_offload.c ALSA: compress: Fix task creation error unwind 2026-06-17 11:04:10 +02:00
control_compat.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
control_led.c ALSA: core: Add scoped cleanup helper for card references 2026-06-04 10:20:41 +02:00
control_trace.h ALSA: control: Verify put() result when in debug mode 2026-02-28 09:32:39 +01:00
control.c ALSA: core: Add scoped cleanup helper for card references 2026-06-04 10:20:41 +02:00
ctljack.c ALSA: jack: Improve string handling in jack_kctl_name_gen 2026-01-27 09:58:37 +01:00
device.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hrtimer.c ALSA: core: Mark some variables as __ro_after_init 2026-05-25 09:31:40 +02:00
hwdep_compat.c ALSA: compat_ioctl: avoid compat_alloc_user_space 2020-09-21 10:37:07 +02:00
hwdep.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
info_oss.c ALSA: info: Use guard() for locking 2024-02-28 15:01:21 +01:00
info.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
init.c ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() 2026-06-14 17:31:54 +02:00
isadma.c sound updates for 6.0-rc1 2022-08-06 10:19:51 -07:00
jack.c ALSA: jack: use scnprintf to improve parse_mask_bits 2026-05-04 13:28:35 +02:00
Kconfig ALSA: Do not build obsolete API 2025-12-07 13:15:59 +01:00
Makefile ALSA: control: Verify put() result when in debug mode 2026-02-28 09:32:39 +01:00
memalloc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
memory.c ALSA: Align the syntax of iov_iter helpers with standard ones 2024-12-30 12:50:04 +01:00
misc.c ALSA: Add simple refcount helper functions 2026-06-11 09:34:09 +02:00
pcm_compat.c ALSA: pcm: Fix unlocked runtime state reads in xfer ioctls 2026-06-06 18:18:04 +02:00
pcm_dmaengine.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pcm_drm_eld.c ALSA: pcm_drm_eld: rate-limit ELD parsing errors 2026-05-16 16:20:07 +02:00
pcm_iec958.c ALSA: iec958: Split status creation and fill 2021-06-08 17:05:41 +02:00
pcm_lib.c ALSA: pcm: fix __le32 cast warning in snd_pcm_set_sync_per_card 2026-06-18 12:33:59 +02:00
pcm_local.h ALSA: pcm: Revert "ALSA: pcm: rewrite snd_pcm_playback_silence()" 2023-05-05 18:23:48 +02:00
pcm_memory.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pcm_misc.c ALSA: core: Add SPDX license id to files 2026-02-18 08:52:08 +01:00
pcm_native.c ALSA: pcm: Fix unlocked state reads in read/write file ops 2026-06-10 16:28:48 +02:00
pcm_param_trace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pcm_timer.c ALSA: pcm_timer: use snd_pcm_direction_name() 2024-08-01 12:50:13 +02:00
pcm_trace.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
pcm.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
rawmidi_compat.c ALSA: rawmidi: Replace with __packed attribute 2023-10-26 09:42:55 +02:00
rawmidi.c ALSA: core: Mark some variables as __ro_after_init 2026-05-25 09:31:40 +02:00
seq_device.c ALSA: seq: Use flexible array for device arguments 2026-06-01 11:28:32 +02:00
sound_kunit.c ALSA: core: Fix possible NULL dereference caused by kunit_kzalloc() 2024-11-27 08:06:31 +01:00
sound_oss.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sound.c ALSA: core: Validate compress device numbers without dynamic minors 2026-03-28 10:55:35 +01:00
timer_compat.c ALSA: timer: Manage timer object with kref 2026-06-10 09:36:28 +02:00
timer.c ALSA: timer: drain a slave's callback before its master detaches it 2026-07-20 10:16:56 +02:00
ump_convert.c ALSA: ump: Explicitly reset RPN with Null RPN 2024-07-31 15:08:39 +02:00
ump.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
vmaster.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00