From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f53.google.com (mail-ej1-f53.google.com [209.85.218.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 71B993B71C7 for ; Mon, 20 Jul 2026 07:14:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784531674; cv=none; b=H+Wl2dO2ReufuTHtkzWENsZ3eSnw6XoPc/wijYM1IqfBPlYzM6HqqGHXKjTyVYGuQx/WvbKsLFFW+i/EjK5wgW1892T6R7UvPpYL7FcuB39zdUX6AjCzId2+4xSr8hcwbxFi+tJnew+jX5BdKtq+T7z+8E3P4HJhwUw43N+ljAs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784531674; c=relaxed/simple; bh=VjA1FIKhgjCtwMBOccoujN3/BZcDsX6IJ7YmyIXhUbQ=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc: Message-Id:References:To; b=B9l4Sc6uW3+pdsXKKgqriVyeby0hOwn6nOAAGdEC9jymBr5Kwkyy3yU4w4r+KWqDbXGdfexsmZLYVIkEyqP7Ihh3N19zXAESuejej88JqgmYup9PtSRGCkBXlPELSlmjqeopWjWxPSTU/YWn5bnViGfDMrqcOJ6SVfWV91y3cKo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=doyensec.com; spf=pass smtp.mailfrom=doyensec.com; dkim=pass (2048-bit key) header.d=doyensec.com header.i=@doyensec.com header.b=Ul6mEPsd; arc=none smtp.client-ip=209.85.218.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=doyensec.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=doyensec.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=doyensec.com header.i=@doyensec.com header.b="Ul6mEPsd" Received: by mail-ej1-f53.google.com with SMTP id a640c23a62f3a-c1677c91969so580803566b.1 for ; Mon, 20 Jul 2026 00:14:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=doyensec.com; s=google; t=1784531666; x=1785136466; darn=vger.kernel.org; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:content-type:from:to:cc :subject:date:message-id:reply-to:content-type; bh=NeZD4ND3M0jkTrNWKT4lBd0LRKrWJlRu5YRE32UTcVk=; b=Ul6mEPsdxqUNuLXdOzbXOtjOBC4T48shJkMP6WlwzAsT9hole41CAfG5rPnVuUuMCx JWZY8VfZCXIWRLFZfih00AVHCTeT63a4cLxludqBuGUMtviDxte3tqrZlQcY/dHTrrE3 do34QxTv9+DpwpwNESriBQsu3IKSzrihrXg6Q6v94kF4sjVZYFL2iWskm95ijFrf0kY7 pckuwk12a+k3xX7OsFlboWKFD6JJCT0pRz6yvlyPI399p5a9aRBabyEIulZGNQR91Xd+ Zvw2rJm6pBoKgn5K1ni0cElGfeXxxY1lC1CfbiKRRTMlW47RJmGe3KGBwTQMsuaXqeV7 /EHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784531666; x=1785136466; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:content-type:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=NeZD4ND3M0jkTrNWKT4lBd0LRKrWJlRu5YRE32UTcVk=; b=rBDuA1Lvihhdr6mS441BmACBqNhjJB+AuieEnwDVKhIY2BKoJYg1A7AwXyaaic0+9c KWcKXO1JBHYE+MuyF1Kf4XB+4N1s71AqfSkaffyM2Tyse4uE6pt2y75V+dn388PHMl+o vD4WNlsc4sj7GMGS3HJ+yBaE+t/2c9ynwL65Y5o820tcHBXW8LZ63CiAiMXrXlGbQkMf wQWjJysjS+xkXqWZX4XZd39azAAdXqgFr5Kz5LTwMUNQXYZ6lQI9vQxqeCsZ+TBWd0JM ApFkLOYJN+e4DikcJ1zNfylMucqD4DoIj60pkN23ikZJUtddlkLaAnvj/hfiPtU86tZR sLDw== X-Gm-Message-State: AOJu0YwvHcxrhMdxlOBzhnYWC7WE89/P2Qcyyw/YVhXkc3Jb7Pwa6Rp6 /bhaJTI4BaGADWFk6wyAYHPxpe7v0n1KMFr+gWp7w/pqy1vqNmX6eFVx4xSBmc/UKfE= X-Gm-Gg: AfdE7cmwHYM8ERHQv6Gz7E2qCF5wxu7HxgGEpVi8B2+aklJ3Jj5WiJdulmDBA+fot/D Ho264Ysa+9yFbeJTuDhZ6cP0PFn8tUtRZ4w81odGrBkgWVGugp3s+eJYM+1pCBXqcnqgtYImIJj qcrz7MB6ocLPypU8aLZ1OH6PQQqUiSIqoIb+O256vTCf/UPosqmFjQeH5Gsv/4/3y4h4EEcnyNg yYRY/wCPOxhmhQkl73/DODH5i1MhqaAwBDgGrYJQAYoirQVrJOjylDinIaxMUBcmYQka/v+y9Gs i3SbI0PhCHg78n9oUNNGgONrlLVxFzvmaMB8tDAFydNt04Tq/N/G5zp2zhjIPWgX7Phy6xHJjVq OdYrifpPOAuY231TozRa+FXeye8m/aR4FPMftFdrYIwOdFqJpTIRuQ8jki2Q9EX5lpTjeyW8bmp 7Ol1LAr1VHENq/M2TZ+MTlgQmT7dyfG4jYrQP9S1BcSK/jA0+bR/2ysT49BOihWatuOxZ7y/azT lrNF1i70Xj/h9BeIYyC5Gbu1luLXYbXDkUFWpl2TNEWdZY= X-Received: by 2002:a17:907:9704:b0:bb7:eb68:514e with SMTP id a640c23a62f3a-c16b477c696mr482401366b.36.1784531665797; Mon, 20 Jul 2026 00:14:25 -0700 (PDT) Received: from smtpclient.apple (83.10.38.128.ipv4.supernova.orange.pl. [83.10.38.128]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-69e6ffe104esm4207682a12.22.2026.07.20.00.14.23 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 20 Jul 2026 00:14:24 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.700.81.1.4\)) Subject: [PATCH 2/2] ALSA: timer: drain a slave's callback before its master detaches it From: Norbert Szetei In-Reply-To: <6F9B6501-8E65-4265-B02C-7EFB240D1664@doyensec.com> Date: Mon, 20 Jul 2026 09:14:12 +0200 Cc: linux-kernel@vger.kernel.org, Takashi Iwai Content-Transfer-Encoding: quoted-printable Message-Id: References: <6F9B6501-8E65-4265-B02C-7EFB240D1664@doyensec.com> To: linux-sound@vger.kernel.org X-Mailer: Apple Mail (2.3826.700.81.1.4) snd_timer_close_locked() drains the closing instance's own in-flight callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a master instance is closed, remove_slave_links() clears each slave's ->timer; the slave's own close then reads timer =3D=3D NULL and takes = the branch that skips the drain entirely (snd_timer_stop_slave() also no-ops on a NULL timer). So a slave whose callback is still running when the master is closed is freed underneath the live callback, leading to use-after-free. Drain the slaves too before remove_slave_links() severs them. snd_timer_stop() has already taken this instance off the active list, so no new slave callback can be queued. Take the slaves off the ack list so a pending one can't fire either, then wait for any that is already in flight. Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven = timers") Cc: Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Szetei --- sound/core/timer.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sound/core/timer.c b/sound/core/timer.c --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -489,10 +489,20 @@ static void snd_timer_close_locked(struct = snd_timer_instance *timeri, snd_timer_stop(timeri); if (timer) { + struct snd_timer_instance *slave; + bool busy; + timer->num_instances--; - /* wait, until the active callback is finished */ + /* unqueue then drain the slaves' callbacks before = remove_slave_links() severs them */ spin_lock_irq(&timer->lock); - while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) { + list_for_each_entry(slave, &timeri->slave_list_head, = open_list) + list_del_init(&slave->ack_list); + for (;;) { + busy =3D timeri->flags & = SNDRV_TIMER_IFLG_CALLBACK; + list_for_each_entry(slave, = &timeri->slave_list_head, open_list) + busy |=3D slave->flags & = SNDRV_TIMER_IFLG_CALLBACK; + if (!busy) + break; spin_unlock_irq(&timer->lock); udelay(10); spin_lock_irq(&timer->lock); } spin_unlock_irq(&timer->lock); remove_slave_links(timeri, timer); -- 2.55.0=