ALSA: timer: drain a slave's callback before its master detaches it

snd_timer_close_locked() drains the closing instance's own in-flight
callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a
master instance is closed, remove_slave_links() clears each slave's
->timer; the slave's own close then reads timer == NULL and takes the
branch that skips the drain entirely (snd_timer_stop_slave() also no-ops
on a NULL timer). So a slave whose callback is still running when the
master is closed is freed underneath the live callback, leading to
use-after-free.

Drain the slaves too before remove_slave_links() severs them.
snd_timer_stop() has already taken this instance off the active list, so
no new slave callback can be queued. Take the slaves off the ack list so
a pending one can't fire either, then wait for any that is already in
flight.

Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/D26598EB-DBF7-4D76-9F71-8E4BD59822D4@doyensec.com

diff --git a/sound/core/timer.c b/sound/core/timer.c
index 0cd01ee722264ed7e045041f6a922a1a9fb50d03..07ef127b29e17120a3f64cd849497ca76758dc91 100644 (file)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -489,10 +489,20 @@ static void snd_timer_close_locked(struct snd_timer_instance *timeri,
        snd_timer_stop(timeri);
 
        if (timer) {
+               struct snd_timer_instance *slave;
+               bool busy;
+
                timer->num_instances--;
-               /* wait, until the active callback is finished */
+               /* unqueue then drain the slaves' callbacks before remove_slave_links() severs them */
                spin_lock_irq(&timer->lock);
-               while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) {
+               list_for_each_entry(slave, &timeri->slave_list_head, open_list)
+                       list_del_init(&slave->ack_list);
+               for (;;) {
+                       busy = timeri->flags & SNDRV_TIMER_IFLG_CALLBACK;
+                       list_for_each_entry(slave, &timeri->slave_list_head, open_list)
+                               busy |= slave->flags & SNDRV_TIMER_IFLG_CALLBACK;
+                       if (!busy)
+                               break;
                        spin_unlock_irq(&timer->lock);
                        udelay(10);
                        spin_lock_irq(&timer->lock);