https://github.com/torvalds/linux
Revision 56b88b50565cd8b946a2d00b0c83927b7ebb055e authored by Clement Lecigne on 13 January 2023, 12:07:45 UTC, committed by Takashi Iwai on 13 January 2023, 13:15:26 UTC
Takes rwsem lock inside snd_ctl_elem_read instead of snd_ctl_elem_read_user
like it was done for write in commit 1fa4445f9adf1 ("ALSA: control - introduce
snd_ctl_notify_one() helper"). Doing this way we are also fixing the following
locking issue happening in the compat path which can be easily triggered and
turned into an use-after-free.
64-bits:
snd_ctl_ioctl
snd_ctl_elem_read_user
[takes controls_rwsem]
snd_ctl_elem_read [lock properly held, all good]
[drops controls_rwsem]
32-bits:
snd_ctl_ioctl_compat
snd_ctl_elem_write_read_compat
ctl_elem_write_read
snd_ctl_elem_read [missing lock, not good]
CVE-2023-0266 was assigned for this issue.
Cc: stable@kernel.org # 5.13+
Signed-off-by: Clement Lecigne <clecigne@google.com>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20230113120745.25464-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent 92a9c0a
Tip revision: 56b88b50565cd8b946a2d00b0c83927b7ebb055e authored by Clement Lecigne on 13 January 2023, 12:07:45 UTC
ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
Tip revision: 56b88b5
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| LICENSES | ||
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| drivers | ||
| fs | ||
| include | ||
| init | ||
| io_uring | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| rust | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .clang-format | -rw-r--r-- | 20.0 KB |
| .cocciconfig | -rw-r--r-- | 59 bytes |
| .get_maintainer.ignore | -rw-r--r-- | 151 bytes |
| .gitattributes | -rw-r--r-- | 62 bytes |
| .gitignore | -rw-r--r-- | 2.0 KB |
| .mailmap | -rw-r--r-- | 24.6 KB |
| .rustfmt.toml | -rw-r--r-- | 369 bytes |
| COPYING | -rw-r--r-- | 496 bytes |
| CREDITS | -rw-r--r-- | 99.3 KB |
| Kbuild | -rw-r--r-- | 2.5 KB |
| Kconfig | -rw-r--r-- | 555 bytes |
| MAINTAINERS | -rw-r--r-- | 681.0 KB |
| Makefile | -rw-r--r-- | 69.5 KB |
| README | -rw-r--r-- | 727 bytes |
Computing file changes ...
