mirror of https://github.com/torvalds/linux.git
f0a868788f
The current code for freeing the emux timer is extremely dangerous:
CPU0 CPU1
---- ----
snd_emux_timer_callback()
snd_emux_free()
spin_lock(&emu->voice_lock)
del_timer(&emu->tlist); <-- returns immediately
spin_unlock(&emu->voice_lock);
[..]
kfree(emu);
spin_lock(&emu->voice_lock);
[BOOM!]
Instead just use del_timer_sync() which will wait for the timer to finish
before continuing. No need to check if the timer is active or not when
doing so.
This doesn't fix the race of a possible re-arming of the timer, but at
least it won't use the data that has just been freed.
[ Fixed unused variable warning by tiwai ]
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| emux.c | ||
| emux_effect.c | ||
| emux_hwdep.c | ||
| emux_nrpn.c | ||
| emux_oss.c | ||
| emux_proc.c | ||
| emux_seq.c | ||
| emux_synth.c | ||
| emux_voice.h | ||
| soundfont.c | ||