Skip to content

Commit ee8413b

Browse files
committed
ALSA: timer: Fix double unlink of active_list
ALSA timer instance object has a couple of linked lists and they are unlinked unconditionally at snd_timer_stop(). Meanwhile snd_timer_interrupt() unlinks it, but it calls list_del() which leaves the element list itself unchanged. This ends up with unlinking twice, and it was caught by syzkaller fuzzer. The fix is to use list_del_init() variant properly there, too. Reported-by: Dmitry Vyukov <dvyukov@google.com> Tested-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent c4a359a commit ee8413b

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

Diff for: sound/core/timer.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -694,7 +694,7 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
694694
} else {
695695
ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
696696
if (--timer->running)
697-
list_del(&ti->active_list);
697+
list_del_init(&ti->active_list);
698698
}
699699
if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) ||
700700
(ti->flags & SNDRV_TIMER_IFLG_FAST))

0 commit comments

Comments
 (0)