diff options
| author | Takashi Iwai <tiwai@suse.de> | 2016-01-12 15:36:27 +0100 |
|---|---|---|
| committer | Willy Tarreau <w@1wt.eu> | 2016-03-12 14:25:48 +0100 |
| commit | af6387516d9267483aa8c77b4d6231261d5a4442 (patch) | |
| tree | cbc8f70b18ee02e0135c18c6e2ce44b5e3913d3d | |
| parent | 44c961009be83d5c353652c75e2ba66ca8ad6ab6 (diff) | |
| download | linux-stable-af6387516d9267483aa8c77b4d6231261d5a4442.tar.gz linux-stable-af6387516d9267483aa8c77b4d6231261d5a4442.tar.bz2 linux-stable-af6387516d9267483aa8c77b4d6231261d5a4442.zip | |
ALSA: seq: Fix race at timer setup and close
commit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream.
ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client. This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.
This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Willy Tarreau <w@1wt.eu>
| -rw-r--r-- | sound/core/seq/seq_queue.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c index e7a8e9e4edb2..a5d191e84ef4 100644 --- a/sound/core/seq/seq_queue.c +++ b/sound/core/seq/seq_queue.c @@ -144,8 +144,10 @@ static struct snd_seq_queue *queue_new(int owner, int locked) static void queue_delete(struct snd_seq_queue *q) { /* stop and release the timer */ + mutex_lock(&q->timer_mutex); snd_seq_timer_stop(q->timer); snd_seq_timer_close(q); + mutex_unlock(&q->timer_mutex); /* wait until access free */ snd_use_lock_sync(&q->use_lock); /* release resources... */ |