diff options
| author | Takashi Iwai <tiwai@suse.de> | 2016-01-30 23:09:08 +0100 |
|---|---|---|
| committer | Luis Henriques <luis.henriques@canonical.com> | 2016-02-25 00:18:40 +0000 |
| commit | 95cd42a4806432bbbd7b914eb2ca4c8f93e49d03 (patch) | |
| tree | 898ea7c751c290763e2ad4e56c7d84fc9bb1d378 /kernel | |
| parent | a293ce87a6c53a070309f150abeffe9823a05c88 (diff) | |
ALSA: timer: Fix link corruption due to double start or stop
commit f784beb75ce82f4136f8a0960d3ee872f7109e09 upstream.
Although ALSA timer code got hardening for races, it still causes
use-after-free error. This is however rather a corrupted linked list,
not actually the concurrent accesses. Namely, when timer start is
triggered twice, list_add_tail() is called twice, too. This ends
up with the link corruption and triggers KASAN error.
The simplest fix would be replacing list_add_tail() with
list_move_tail(), but fundamentally it's the problem that we don't
check the double start/stop correctly. So, the right fix here is to
add the proper checks to snd_timer_start() and snd_timer_stop() (and
their variants).
BugLink: http://lkml.kernel.org/r/CACT4Y+ZyPRoMQjmawbvmCEDrkBD2BQuH7R09=eOkf5ESK8kJAw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Diffstat (limited to 'kernel')
0 files changed, 0 insertions, 0 deletions