mirror of
https://github.com/torvalds/linux.git
synced 2024-11-22 20:22:09 +00:00
67a01afaf3
The aloop driver tries to stop the pending timer via timer_del() in the trigger callback and in the close callback. The former is correct, as it's an atomic operation, while the latter expects that the timer gets really removed and proceeds the resource releases after that. But timer_del() doesn't synchronize, hence the running timer may still access the released resources. A similar situation can be also seen in the prepare callback after trigger(STOP) where the prepare tries to re-initialize the things while a timer is still running. The problems like the above are seen indirectly in some syzkaller reports (although it's not 100% clear whether this is the only cause, as the race condition is quite narrow and not always easy to trigger). For addressing these issues, this patch adds the explicit alls of timer_del_sync() in some places, so that the pending timer is properly killed / synced. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|---|---|---|
| .. | ||
| mpu401 | ||
| opl3 | ||
| opl4 | ||
| pcsp | ||
| vx | ||
| aloop.c | ||
| dummy.c | ||
| Kconfig | ||
| Makefile | ||
| ml403-ac97cr.c | ||
| mtpav.c | ||
| mts64.c | ||
| pcm-indirect2.c | ||
| pcm-indirect2.h | ||
| portman2x4.c | ||
| serial-u16550.c | ||
| virmidi.c | ||