diff options
| author | Steven Rostedt (Google) <rostedt@goodmis.org> | 2022-10-27 06:12:36 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-11-03 17:52:27 +0300 |
| commit | 904209ea21b3cdd82589e6ec7ab7136a1d0bc72d (patch) | |
| tree | ef2b68235ce92b1416c54e0c7eb6b73fbcd267ec /sound/synth/emux | |
| parent | db226f39c213e57269fc21b63abfc6c8b468ec79 (diff) | |
| download | linux-904209ea21b3cdd82589e6ec7ab7136a1d0bc72d.tar.xz | |
ALSA: Use del_timer_sync() before freeing timer
commit f0a868788fcbf63cdab51f5adcf73b271ede8164 upstream.
The current code for freeing the emux timer is extremely dangerous:
CPU0 CPU1
---- ----
snd_emux_timer_callback()
snd_emux_free()
spin_lock(&emu->voice_lock)
del_timer(&emu->tlist); <-- returns immediately
spin_unlock(&emu->voice_lock);
[..]
kfree(emu);
spin_lock(&emu->voice_lock);
[BOOM!]
Instead just use del_timer_sync() which will wait for the timer to finish
before continuing. No need to check if the timer is active or not when
doing so.
This doesn't fix the race of a possible re-arming of the timer, but at
least it won't use the data that has just been freed.
[ Fixed unused variable warning by tiwai ]
Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20221026231236.6834b551@gandalf.local.home
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'sound/synth/emux')
| -rw-r--r-- | sound/synth/emux/emux.c | 7 |
1 files changed, 1 insertions, 6 deletions
diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c index d8140ad98d5f..6f6f40fbe548 100644 --- a/sound/synth/emux/emux.c +++ b/sound/synth/emux/emux.c @@ -138,15 +138,10 @@ EXPORT_SYMBOL(snd_emux_register); */ int snd_emux_free(struct snd_emux *emu) { - unsigned long flags; - if (! emu) return -EINVAL; - spin_lock_irqsave(&emu->voice_lock, flags); - if (emu->timer_active) - del_timer(&emu->tlist); - spin_unlock_irqrestore(&emu->voice_lock, flags); + del_timer_sync(&emu->tlist); snd_emux_proc_free(emu); snd_emux_delete_virmidi(emu); |