diff options
| author | Takashi Iwai <tiwai@suse.de> | 2016-01-13 21:35:06 +0100 |
|---|---|---|
| committer | Rygebin <kaankulahli2@gmail.com> | 2017-06-02 13:49:48 +0000 |
| commit | b82aaf666dc9d1c58bf45c6c4727efcefacb19d7 (patch) | |
| tree | acb2a526a6b941bd98ebd6d89f5e7cb1615146b4 /net/lapb/lapb_timer.c | |
| parent | 044ae576db5ab48f881c16f563bab40e4ac230aa (diff) | |
ALSA: timer: Fix double unlink of active_list
ALSA timer instance object has a couple of linked lists and they are
unlinked unconditionally at snd_timer_stop(). Meanwhile
snd_timer_interrupt() unlinks it, but it calls list_del() which leaves
the element list itself unchanged. This ends up with unlinking twice,
and it was caught by syzkaller fuzzer.
The fix is to use list_del_init() variant properly there, too.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions