]> www.infradead.org Git - users/jedix/linux-maple.git/commitdiff
ALSA: seq: Fix race at timer setup and close
authorTakashi Iwai <tiwai@suse.de>
Tue, 12 Jan 2016 14:36:27 +0000 (15:36 +0100)
committerChuck Anderson <chuck.anderson@oracle.com>
Thu, 26 May 2016 22:43:13 +0000 (15:43 -0700)
Orabug: 23330523

commit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream.

ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client.  This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.

This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 49c9eb3db86407868a664ade6da041fabeb457f8)

Signed-off-by: Dan Duval <dan.duval@oracle.com>
sound/core/seq/seq_queue.c

index a0cda38205b9760bc6e1d1943c8f1deb05ded567..77ec214203558ed6211aa7ade21ae159f1e88840 100644 (file)
@@ -142,8 +142,10 @@ static struct snd_seq_queue *queue_new(int owner, int locked)
 static void queue_delete(struct snd_seq_queue *q)
 {
        /* stop and release the timer */
+       mutex_lock(&q->timer_mutex);
        snd_seq_timer_stop(q->timer);
        snd_seq_timer_close(q);
+       mutex_unlock(&q->timer_mutex);
        /* wait until access free */
        snd_use_lock_sync(&q->use_lock);
        /* release resources... */