system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-10-09 21:05:10 +00:00
Code Issues Packages Projects Releases Wiki Activity
linux/sound/core
History
Takashi Iwai 83e197a841 ALSA: seq: Fix race of snd_seq_timer_open() 
The timer instance per queue is exclusive, and snd_seq_timer_open()
should have managed the concurrent accesses.  It looks as if it's
checking the already existing timer instance at the beginning, but
it's not right, because there is no protection, hence any later
concurrent call of snd_seq_timer_open() may override the timer
instance easily.  This may result in UAF, as the leftover timer
instance can keep running while the queue itself gets closed, as
spotted by syzkaller recently.

For avoiding the race, add a proper check at the assignment of
tmr->timeri again, and return -EBUSY if it's been already registered.

Reported-by: syzbot+ddc1260a83ed1cbf6fb5@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/000000000000dce34f05c42f110c@google.com
Link: https://lore.kernel.org/r/20210610152059.24633-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-06-10 17:21:30 +02:00
..
oss ALSA: core: avoid -Wempty-body warnings 2021-03-22 12:26:00 +01:00
seq ALSA: seq: Fix race of snd_seq_timer_open() 2021-06-10 17:21:30 +02:00
compress_offload.c ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
control.c ALSA: control: Fix racy management of user ctl memory size account 2021-04-16 09:57:49 +02:00
control_compat.c ALSA: compat_ioctl: avoid compat_alloc_user_space 2020-09-21 10:37:07 +02:00
control_led.c ALSA: control led: fix memory leak in snd_ctl_led_register 2021-06-02 09:37:40 +02:00
ctljack.c ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
device.c ALSA: core: Add snd_device_get_state() helper 2020-03-23 18:09:19 +01:00
hrtimer.c ALSA: timer: Replace tasklet with work 2020-09-09 18:32:52 +02:00
hwdep.c ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
hwdep_compat.c ALSA: compat_ioctl: avoid compat_alloc_user_space 2020-09-21 10:37:07 +02:00
info.c ALSA: info: Drop WARN_ON() from buffer NULL sanity check 2020-07-17 10:59:38 +02:00
info_oss.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
init.c ALSA: core: remove redundant spin_lock pair in snd_card_disconnect 2021-03-30 13:50:15 +02:00
isadma.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jack.c ALSA: jack: implement software jack injection via debugfs 2021-02-02 10:37:07 +01:00
Kconfig ALSA: control - add generic LED trigger module as the new control layer 2021-03-30 15:33:58 +02:00
Makefile ALSA: control - add generic LED trigger module as the new control layer 2021-03-30 15:33:58 +02:00
memalloc.c ALSA: memalloc: Align buffer allocations in page size 2020-12-18 17:09:10 +01:00
memory.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
misc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
pcm.c ALSA: pcm: Use for_each_pcm_substream() macro 2021-02-08 16:01:01 +01:00
pcm_compat.c ALSA: pcm: Fix sparse warnings wrt snd_pcm_state_t 2020-01-31 16:23:13 +01:00
pcm_dmaengine.c ASoC: dmaengine_pcm: add peripheral configuration 2021-02-05 17:16:41 +00:00
pcm_drm_eld.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
pcm_iec958.c ALSA: core: pcm_iec958: fix kernel-doc 2020-07-07 10:22:33 +02:00
pcm_lib.c ALSA: pcm: use krealloc_array() 2020-12-15 12:13:37 -08:00
pcm_local.h ALSA: pcm: Use for_each_pcm_substream() macro 2021-02-08 16:01:01 +01:00
pcm_memory.c ALSA: core: avoid -Wempty-body warnings 2021-03-22 12:26:00 +01:00
pcm_misc.c ASoC: Updates for v5.7 2020-03-30 13:43:00 +02:00
pcm_native.c ALSA: pcm: Fix couple of typos 2021-03-26 09:12:30 +01:00
pcm_param_trace.h
pcm_timer.c ALSA: timer: Constify snd_timer_hardware definitions 2020-01-03 09:24:07 +01:00
pcm_trace.h
rawmidi.c ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
rawmidi_compat.c ALSA: Avoid using timespec for struct snd_rawmidi_status 2019-12-11 22:06:16 +01:00
seq_device.c ALSA: core: avoid -Wempty-body warnings 2021-03-22 12:26:00 +01:00
sgbuf.c ALSA: memalloc: Make SG-buffer helper usable for continuous buffer, too 2020-06-15 18:01:52 +02:00
sound.c ALSA: core - add missing compress device type to /proc/asound/devices 2021-02-10 10:31:53 +01:00
sound_oss.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
timer.c ALSA: timer: Fix master timer notification 2021-06-03 09:39:58 +02:00
timer_compat.c ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
vmaster.c ALSA: Replace the word "slave" in vmaster API 2020-07-20 10:10:47 +02:00