]> www.infradead.org Git - users/jedix/linux-maple.git/commit
ALSA: seq: Fix race at timer setup and close
authorTakashi Iwai <tiwai@suse.de>
Tue, 12 Jan 2016 14:36:27 +0000 (15:36 +0100)
committerChuck Anderson <chuck.anderson@oracle.com>
Thu, 26 May 2016 22:43:13 +0000 (15:43 -0700)
commit47deab43356c899781f3e751ff908250066c0593
tree70c43c359192a5400d03138458a698594942c22f
parent2cdc460fe5f873486b32c986f866d0d6a2812417
ALSA: seq: Fix race at timer setup and close

Orabug: 23330523

commit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream.

ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client.  This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.

This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 49c9eb3db86407868a664ade6da041fabeb457f8)

Signed-off-by: Dan Duval <dan.duval@oracle.com>
sound/core/seq/seq_queue.c