Android O MR1 IOT Release Smart Display r30 (OIMI.200528.001)
[ALPS05020298] ALSA: timer: Fix incorrectly assigned timer instance

The clean up commit 41672c0c24a6 ("ALSA: timer: Simplify error path in
snd_timer_open()") unified the error handling code paths with the
standard goto, but it introduced a subtle bug: the timer instance is
stored in snd_timer_open() incorrectly even if it returns an error.
This may eventually lead to UAF, as spotted by fuzzer.

In this patch, we fix it by not re-using timeri variable but a
temporary variable for testing the exclusive connection, so timeri
remains NULL at that point.

Bug: 151000310
Change-Id: I9ce2d4b5d992ba76dda740caea1046efe0ff782c
Signed-off-by: chipeng chang <>
Signed-off-by: Yingjoe Chen <>
CR-Id: ALPS05020298
Feature: [Module]Audio Kernel
(cherry-pick from b11912c59a9ff64e965bbb82137a70ae6144ce7e)
1 file changed