https://github.com/torvalds/linux
Revision 4842e98f26dd80be3623c4714a244ba52ea096a8 authored by Takashi Iwai on 08 February 2017, 11:35:39 UTC, committed by Takashi Iwai on 08 February 2017, 11:42:37 UTC
When a sequencer queue is created in snd_seq_queue_alloc(),it adds the
new queue element to the public list before referencing it.  Thus the
queue might be deleted before the call of snd_seq_queue_use(), and it
results in the use-after-free error, as spotted by syzkaller.

The fix is to reference the queue object at the right time.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent f3d8331
Raw File
Tip revision: 4842e98f26dd80be3623c4714a244ba52ea096a8 authored by Takashi Iwai on 08 February 2017, 11:35:39 UTC
ALSA: seq: Fix race at creating a queue
Tip revision: 4842e98
locking-selftest-spin-hardirq.h
#include "locking-selftest-spin.h"
#include "locking-selftest-hardirq.h"
back to top