Revision 4842e98f26dd80be3623c4714a244ba52ea096a8 authored by Takashi Iwai on 08 February 2017, 11:35:39 UTC, committed by Takashi Iwai on 08 February 2017, 11:42:37 UTC
When a sequencer queue is created in snd_seq_queue_alloc(),it adds the new queue element to the public list before referencing it. Thus the queue might be deleted before the call of snd_seq_queue_use(), and it results in the use-after-free error, as spotted by syzkaller. The fix is to reference the queue object at the right time. Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent f3d8331
| File | Mode | Size |
|---|---|---|
| Kconfig | -rw-r--r-- | 68.3 KB |
| Makefile | -rw-r--r-- | 1.2 KB |
| calibrate.c | -rw-r--r-- | 8.5 KB |
| do_mounts.c | -rw-r--r-- | 14.6 KB |
| do_mounts.h | -rw-r--r-- | 1.4 KB |
| do_mounts_initrd.c | -rw-r--r-- | 3.4 KB |
| do_mounts_md.c | -rw-r--r-- | 8.2 KB |
| do_mounts_rd.c | -rw-r--r-- | 8.3 KB |
| init_task.c | -rw-r--r-- | 772 bytes |
| initramfs.c | -rw-r--r-- | 13.8 KB |
| main.c | -rw-r--r-- | 25.3 KB |
| noinitramfs.c | -rw-r--r-- | 1.5 KB |
| version.c | -rw-r--r-- | 1.2 KB |
Computing file changes ...
