From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34B30C433EF for ; Wed, 3 Nov 2021 16:06:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1E3EA610E5 for ; Wed, 3 Nov 2021 16:06:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232770AbhKCQJU (ORCPT ); Wed, 3 Nov 2021 12:09:20 -0400 Received: from smtp-out1.suse.de ([195.135.220.28]:35622 "EHLO smtp-out1.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232749AbhKCQJT (ORCPT ); Wed, 3 Nov 2021 12:09:19 -0400 Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out1.suse.de (Postfix) with ESMTP id B639E21952; Wed, 3 Nov 2021 16:06:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1635955601; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=c0mHsJ6qQaBk3pcqi2j3lzukH4beIAHJNv0ekMXLZ+s=; b=FrdWvGUFPyxDPd6M8w0E+p9x/NLna2i7bXyuEjCXk7ClS+MEmARVqCbS6CPc5W4AIAK69O cwXP4+/bCJrSm7b80uCw3IoBjvDeqqZH2pdFNIDXBmzh0Ib5HRis/tGntwi69Tr1/JY9WD ifiTBKJsstrNvrYhERtG6J/riwMiOz4= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1635955601; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=c0mHsJ6qQaBk3pcqi2j3lzukH4beIAHJNv0ekMXLZ+s=; b=9ixKY4jExs6qVivLdHvvTzLsNkYj4gdzAZT1jqSzEXqNOfz7UHu0FYLWlDcBtlF1Zyx1v3 9M5VPvLkScwhBoAA== Received: from alsa1.suse.de (alsa1.suse.de [10.160.4.42]) by relay2.suse.de (Postfix) with ESMTP id 95798A3B8B; Wed, 3 Nov 2021 16:06:41 +0000 (UTC) Date: Wed, 03 Nov 2021 17:06:41 +0100 Message-ID: From: Takashi Iwai To: Wang Wensheng Cc: , , , , , , Subject: Re: [PATCH -next v2] ALSA: timer: Fix use-after-free problem In-Reply-To: References: <20211103033517.80531-1-wangwensheng4@huawei.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 03 Nov 2021 16:52:31 +0100, Takashi Iwai wrote: > > On Wed, 03 Nov 2021 04:35:17 +0100, > Wang Wensheng wrote: > > > > When the timer instance was add into ack_list but was not currently in > > process, the user could stop it via snd_timer_stop1() without delete it > > from the ack_list. Then the user could free the timer instance and when > > it was actually processed UAF occurred. > > > > This issue could be reproduced via testcase snd_timer01 in ltp - running > > several instances of that testcase at the same time. > > > > What I actually met was that the ack_list of the timer broken and the > > kernel went into deadloop with irqoff. That could be detected by > > hardlockup detector on board or when we run it on qemu, we could use gdb > > to dump the ack_list when the console has no response. > > > > To fix this issue, we delete the timer instance from ack_list and > > active_list unconditionally in snd_timer_stop1(). > > > > Signed-off-by: Wang Wensheng > > Suggested-by: Takashi Iwai > > Thanks, applied now. BTW, while reviewing the patch, I noticed that we have also the similar code path for a slave timer instance that has the same kind of linked list entries. I'll submit the corresponding fix patch. Takashi