]> www.infradead.org Git - users/jedix/linux-maple.git/commit
ALSA: rawmidi: Change resized buffers atomically
authorTakashi Iwai <tiwai@suse.de>
Tue, 17 Jul 2018 15:26:43 +0000 (17:26 +0200)
committerBrian Maly <brian.maly@oracle.com>
Tue, 4 Dec 2018 20:51:05 +0000 (15:51 -0500)
commit7fc15f7cc2da195cd1bd1730e1d4473671f56be8
treecab538fc40d17787c861f8730caaa5914324865f
parent57f7422cfb21150a42b7b426a54b462c24e1b0d2
ALSA: rawmidi: Change resized buffers atomically

The SNDRV_RAWMIDI_IOCTL_PARAMS ioctl may resize the buffers and the
current code is racy.  For example, the sequencer client may write to
buffer while it being resized.

As a simple workaround, let's switch to the resized buffer inside the
stream runtime lock.

Reported-by: syzbot+52f83f0ea8df16932f7f@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
(cherry picked from commit 39675f7a7c7e7702f7d5341f1e0d01db746543a0)

Orabug: 28898636
CVE: CVE-2018-10902

Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
Signed-off-by: Allen Pais <allen.pais@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
sound/core/rawmidi.c