summaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2017-12-14 16:44:12 +0100
committerTakashi Iwai <tiwai@suse.de>2017-12-14 16:52:31 +0100
commitc1cfd9025cc394fd137a01159d74335c5ac978ce (patch)
treeb22924a25878818c8a433d41ad3f4e66f7c2b0ba /fs
parent2b4584d00a6bc02b63ab3c7213060d41a74bdff1 (diff)
downloadlinux-c1cfd9025cc394fd137a01159d74335c5ac978ce.tar.gz
linux-c1cfd9025cc394fd137a01159d74335c5ac978ce.tar.bz2
linux-c1cfd9025cc394fd137a01159d74335c5ac978ce.zip
ALSA: rawmidi: Avoid racy info ioctl via ctl device
The rawmidi also allows to obtaining the information via ioctl of ctl API. It means that user can issue an ioctl to the rawmidi device even when it's being removed as long as the control device is present. Although the code has some protection via the global register_mutex, its range is limited to the search of the corresponding rawmidi object, and the mutex is already unlocked at accessing the rawmidi object. This may lead to a use-after-free. For avoiding it, this patch widens the application of register_mutex to the whole snd_rawmidi_info_select() function. We have another mutex per rawmidi object, but this operation isn't very hot path, so it shouldn't matter from the performance POV. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'fs')
0 files changed, 0 insertions, 0 deletions