[PATCH 0/3] ALSA: more fixes for timer

[Takashi Iwai]

Hi,

as there are still open holes in ALSA timer code that may lead to
UAFs, here is a patch to address more drastically, by introducing the
refcounting for the timer object's lifecycle.  With this change, the
previous workaround is no longer needed, hence it's reverted in the
second patch.  And, the third one is to assure the pending work being
finished at freeing.  I don't think we've received a report about it,
but just to be sure.

This is targeted for 7.2.


Takashi

===

Takashi Iwai (3):
  ALSA: timer: Manage timer object with kref
  Revert "ALSA: timer: Fix UAF at snd_timer_user_params()"
  ALSA: timer: Disable work at freeing timer object

 include/sound/timer.h      |   6 +++
 sound/core/seq/seq_timer.c |  11 ++--
 sound/core/timer.c         | 107 +++++++++++++++++++++++++++----------
 sound/core/timer_compat.c  |   5 +-
 4 files changed, 97 insertions(+), 32 deletions(-)

-- 
2.54.0