diff options
| author | Takashi Iwai <[email protected]> | 2016-01-30 22:09:08 +0000 |
|---|---|---|
| committer | Takashi Iwai <[email protected]> | 2016-02-01 11:23:29 +0000 |
| commit | f784beb75ce82f4136f8a0960d3ee872f7109e09 (patch) | |
| tree | 382c915eae8dc43cee1e71fd0c4b5df0d2644acf /fs/btrfs/dev-replace.c | |
| parent | ALSA: seq: Fix yet another races among ALSA timer accesses (diff) | |
| download | kernel-f784beb75ce82f4136f8a0960d3ee872f7109e09.tar.gz kernel-f784beb75ce82f4136f8a0960d3ee872f7109e09.zip | |
ALSA: timer: Fix link corruption due to double start or stop
Although ALSA timer code got hardening for races, it still causes
use-after-free error. This is however rather a corrupted linked list,
not actually the concurrent accesses. Namely, when timer start is
triggered twice, list_add_tail() is called twice, too. This ends
up with the link corruption and triggers KASAN error.
The simplest fix would be replacing list_add_tail() with
list_move_tail(), but fundamentally it's the problem that we don't
check the double start/stop correctly. So, the right fix here is to
add the proper checks to snd_timer_start() and snd_timer_stop() (and
their variants).
BugLink: http://lkml.kernel.org/r/CACT4Y+ZyPRoMQjmawbvmCEDrkBD2BQuH7R09=eOkf5ESK8kJAw@mail.gmail.com
Reported-by: Dmitry Vyukov <[email protected]>
Cc: <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
Diffstat (limited to 'fs/btrfs/dev-replace.c')
0 files changed, 0 insertions, 0 deletions