linux-next.git/sound/core/timer.c, branch master

Merge branch 'for-next' of ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git

2026-07-20T14:24:00+00:00

ALSA: timer: drain a slave's callback before its master detaches it

2026-07-20T08:16:56+00:00

snd_timer_close_locked() drains the closing instance's own in-flight callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a master instance is closed, remove_slave_links() clears each slave's ->timer; the slave's own close then reads timer == NULL and takes the branch that skips the drain entirely (snd_timer_stop_slave() also no-ops on a NULL timer). So a slave whose callback is still running when the master is closed is freed underneath the live callback, leading to use-after-free. Drain the slaves too before remove_slave_links() severs them. snd_timer_stop() has already taken this instance off the active list, so no new slave callback can be queued. Take the slaves off the ack list so a pending one can't fire either, then wait for any that is already in flight. Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Szetei Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/D26598EB-DBF7-4D76-9F71-8E4BD59822D4@doyensec.com

ALSA: timer: don't re-enter an instance callback that is still running

2026-07-20T08:16:56+00:00

The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two threads triggering the same utimer can run snd_timer_interrupt() on one snd_timer concurrently. snd_timer_process_callbacks() drops timer->lock around each instance callback and marks the in-flight callback with the single SNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that bit to drain an in-flight callback before freeing the instance. The bit cannot represent two concurrent callbacks: when a second interrupt re-queues an instance whose callback is still running, both run at once, the first to finish clears the bit, and the close-path drain then frees the instance (and its callback_data) while the other callback is still live - a use-after-free reachable by any user able to open /dev/snd/timer, both via a user timer instance and via a sequencer queue timer bound to the utimer. snd_timer_interrupt() sets IFLG_CALLBACK before dropping timer->lock, so a concurrent interrupt already observes it under the lock. Skip re-queuing an instance (and its slaves) to the ack/sack list while its callback is in flight; the accumulated pticks are delivered on the next tick, so no event is lost. Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers") Cc: stable@vger.kernel.org Suggested-by: Takashi Iwai Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Szetei Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/6F9B6501-8E65-4265-B02C-7EFB240D1664@doyensec.com

ALSA: core: Clean up file_operations definitions

2026-07-13T10:01:27+00:00

Align file_operations initializers with tabs to match the standard kernel coding style and improve readability. Signed-off-by: bui duc phuc Link: https://patch.msgid.link/20260708140624.562403-1-phucduc.bui@gmail.com Signed-off-by: Takashi Iwai

ALSA: timer: Drop redundant stream_open() return check

2026-07-03T11:05:31+00:00

The previous conversion from nonseekable_open() to stream_open() retained the existing error check. Since stream_open() always returns 0, remove the dead error handling path. Signed-off-by: bui duc phuc Reviewed-by: Cezary Rojewski Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260702084445.519669-8-phucduc.bui@gmail.com

ALSA: timer: Fix racy timeri->timer changes with rwlock

2026-06-14T15:32:18+00:00

Although we've covered the races around the timer object assignment and release for timer instances, there are still races at starting or stopping the timer instance. They refer to timeri->timer without lock, hence they can still trigger UAFs. For addressing it, this patch changes the existing slave_active_lock spinlock to timeri_lock rwlock. It's a global rwlock applied as read-lock when snd_timer_start() & co are called as well as snd_timeri_timer_get() is called. In turn, the places where timeri->timer is assigned or released are covered by the write-lock. The patch replaces spinlock_irqsave with spinlock in a couple of spaces because they are now already protected by timeri_lock, too. Reported-by: Kyle Zeng Link: https://patch.msgid.link/20260614090714.773216-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: timer: Disable work at freeing timer object

2026-06-10T07:36:28+00:00

There might be a pending work at freeing a timer object, hence clean it up properly. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260609115100.806869-4-tiwai@suse.de

Revert "ALSA: timer: Fix UAF at snd_timer_user_params()"

2026-06-10T07:36:28+00:00

This reverts commit 053a401b592be424fea9d57c789f66cd5d8cec11. With the change of the timer object lifecycle with kref, this temporary workaround is no longer needed. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260609115100.806869-3-tiwai@suse.de

ALSA: timer: Manage timer object with kref

2026-06-10T07:36:28+00:00

So far we've tried to address UAFs in ALSA timer code by applying the locks at various places, but the fundamental problem is that the timer object may be released while the belonging timer instance objects are still present and accessing to it. This patch is a more proper fix to address that issue, namely, by refcounting and keeping the timer object. The basic implementation is to use kref for the refcount of the timer object, and take/release the reference at assigning/releasing the instance, as well as at referring from ioctls or ALSA sequencer code. The reference from ioctl or ALSA sequencer is abstracted with snd_timeri_timer auto-cleanup. Note that this change assumes that the code already took the fix commit da3039e91d1f ("ALSA: timer: Forcibly close timer instances at closing"); otherwise the refcount may be unbalanced when the timer is freed while slave instances are still present. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260609115100.806869-2-tiwai@suse.de

ALSA: timer: Fix UAF at snd_timer_user_params()

2026-06-07T07:23:44+00:00

At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter. Reported-by: Kyle Zeng Tested-by: Kyle Zeng Cc: Link: https://patch.msgid.link/20260606161145.1933447-2-tiwai@suse.de Signed-off-by: Takashi Iwai