https://github.com/torvalds/linux
Revision 4842e98f26dd80be3623c4714a244ba52ea096a8 authored by Takashi Iwai on 08 February 2017, 11:35:39 UTC, committed by Takashi Iwai on 08 February 2017, 11:42:37 UTC
When a sequencer queue is created in snd_seq_queue_alloc(),it adds the
new queue element to the public list before referencing it.  Thus the
queue might be deleted before the call of snd_seq_queue_use(), and it
results in the use-after-free error, as spotted by syzkaller.

The fix is to reference the queue object at the right time.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent f3d8331
History
Tip revision: 4842e98f26dd80be3623c4714a244ba52ea096a8 authored by Takashi Iwai on 08 February 2017, 11:35:39 UTC
ALSA: seq: Fix race at creating a queue
Tip revision: 4842e98
File Mode Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.3 KB
.mailmap -rw-r--r-- 7.7 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 96.0 KB
Kbuild -rw-r--r-- 2.8 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 383.0 KB
Makefile -rw-r--r-- 57.7 KB
README -rw-r--r-- 722 bytes

README

back to top