ALSA: timer: don't re-enter an instance callback that is still running

The userspace-driven timer (utimer) TRIGGER ioctl calls
snd_timer_interrupt() directly with no serialization, so two threads
triggering the same utimer can run snd_timer_interrupt() on one
snd_timer concurrently.

snd_timer_process_callbacks() drops timer->lock around each instance
callback and marks the in-flight callback with the single
SNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that
bit to drain an in-flight callback before freeing the instance. The bit
cannot represent two concurrent callbacks: when a second interrupt
re-queues an instance whose callback is still running, both run at once,
the first to finish clears the bit, and the close-path drain then frees
the instance (and its callback_data) while the other callback is still
live - a use-after-free reachable by any user able to open
/dev/snd/timer, both via a user timer instance and via a sequencer queue
timer bound to the utimer.

snd_timer_interrupt() sets IFLG_CALLBACK before dropping timer->lock, so
a concurrent interrupt already observes it under the lock. Skip
re-queuing an instance (and its slaves) to the ack/sack list while its
callback is in flight; the accumulated pticks are delivered on the next
tick, so no event is lost.

Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
Cc: stable@vger.kernel.org
Suggested-by: Takashi Iwai <tiwai@suse.de>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/6F9B6501-8E65-4265-B02C-7EFB240D1664@doyensec.com

diff --git a/sound/core/timer.c b/sound/core/timer.c
index 51c6ac4df9f4732f8012ac9735fc85cd13819933..0cd01ee722264ed7e045041f6a922a1a9fb50d03 100644 (file)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -927,12 +927,15 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
                        ack_list_head = &timer->ack_list_head;
                else
                        ack_list_head = &timer->sack_list_head;
-               if (list_empty(&ti->ack_list))
+               /* don't requeue an instance whose callback is still running */
+               if (list_empty(&ti->ack_list) &&
+                   !(ti->flags & SNDRV_TIMER_IFLG_CALLBACK))
                        list_add_tail(&ti->ack_list, ack_list_head);
                list_for_each_entry(ts, &ti->slave_active_head, active_list) {
                        ts->pticks = ti->pticks;
                        ts->resolution = resolution;
-                       if (list_empty(&ts->ack_list))
+                       if (list_empty(&ts->ack_list) &&
+                           !(ts->flags & SNDRV_TIMER_IFLG_CALLBACK))
                                list_add_tail(&ts->ack_list, ack_list_head);
                }
        }