ALSA: timer: Fix link corruption due to double start or stop
authorTakashi Iwai <tiwai@suse.de>
Sat, 30 Jan 2016 22:09:08 +0000 (23:09 +0100)
committerTakashi Iwai <tiwai@suse.de>
Mon, 1 Feb 2016 11:23:29 +0000 (12:23 +0100)
commitf784beb75ce82f4136f8a0960d3ee872f7109e09
tree382c915eae8dc43cee1e71fd0c4b5df0d2644acf
parent2cdc7b636d55cbcf42e1e6c8accd85e62d3e9ae8
ALSA: timer: Fix link corruption due to double start or stop

Although ALSA timer code got hardening for races, it still causes
use-after-free error.  This is however rather a corrupted linked list,
not actually the concurrent accesses.  Namely, when timer start is
triggered twice, list_add_tail() is called twice, too.  This ends
up with the link corruption and triggers KASAN error.

The simplest fix would be replacing list_add_tail() with
list_move_tail(), but fundamentally it's the problem that we don't
check the double start/stop correctly.  So, the right fix here is to
add the proper checks to snd_timer_start() and snd_timer_stop() (and
their variants).

BugLink: http://lkml.kernel.org/r/CACT4Y+ZyPRoMQjmawbvmCEDrkBD2BQuH7R09=eOkf5ESK8kJAw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/timer.c