Revision 4842e98f26dd80be3623c4714a244ba52ea096a8 authored by Takashi Iwai on 08 February 2017, 11:35:39 UTC, committed by Takashi Iwai on 08 February 2017, 11:42:37 UTC
When a sequencer queue is created in snd_seq_queue_alloc(),it adds the new queue element to the public list before referencing it. Thus the queue might be deleted before the call of snd_seq_queue_use(), and it results in the use-after-free error, as spotted by syzkaller. The fix is to reference the queue object at the right time. Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent f3d8331
File | Mode | Size |
---|---|---|
Kconfig | -rw-r--r-- | 68.3 KB |
Makefile | -rw-r--r-- | 1.2 KB |
calibrate.c | -rw-r--r-- | 8.5 KB |
do_mounts.c | -rw-r--r-- | 14.6 KB |
do_mounts.h | -rw-r--r-- | 1.4 KB |
do_mounts_initrd.c | -rw-r--r-- | 3.4 KB |
do_mounts_md.c | -rw-r--r-- | 8.2 KB |
do_mounts_rd.c | -rw-r--r-- | 8.3 KB |
init_task.c | -rw-r--r-- | 772 bytes |
initramfs.c | -rw-r--r-- | 13.8 KB |
main.c | -rw-r--r-- | 25.3 KB |
noinitramfs.c | -rw-r--r-- | 1.5 KB |
version.c | -rw-r--r-- | 1.2 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...