Revision 7e1d90f60a0d501c8503e636942ca704a454d910 authored by Daniel Mentz on 14 August 2017, 21:46:01 UTC, committed by Takashi Iwai on 15 August 2017, 06:02:35 UTC
commit 4842e98f26dd80be3623c4714a244ba52ea096a8 ("ALSA: seq: Fix race at creating a queue") attempted to fix a race reported by syzkaller. That fix has been described as follows: " When a sequencer queue is created in snd_seq_queue_alloc(),it adds the new queue element to the public list before referencing it. Thus the queue might be deleted before the call of snd_seq_queue_use(), and it results in the use-after-free error, as spotted by syzkaller. The fix is to reference the queue object at the right time. " Even with that fix in place, syzkaller reported a use-after-free error. It specifically pointed to the last instruction "return q->queue" in snd_seq_queue_alloc(). The pointer q is being used after kfree() has been called on it. It turned out that there is still a small window where a race can happen. The window opens at snd_seq_ioctl_create_queue()->snd_seq_queue_alloc()->queue_list_add() and closes at snd_seq_ioctl_create_queue()->queueptr()->snd_use_lock_use(). Between these two calls, a different thread could delete the queue and possibly re-create a different queue in the same location in queue_list. This change prevents this situation by calling snd_use_lock_use() from snd_seq_queue_alloc() prior to calling queue_list_add(). It is then the caller's responsibility to call snd_use_lock_free(&q->use_lock). Fixes: 4842e98f26dd ("ALSA: seq: Fix race at creating a queue") Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Daniel Mentz <danielmentz@google.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent 8df4b00
File | Mode | Size |
---|---|---|
Kconfig | -rw-r--r-- | 13.7 KB |
Makefile | -rw-r--r-- | 2.1 KB |
core.c | -rw-r--r-- | 24.0 KB |
pwm-ab8500.c | -rw-r--r-- | 3.3 KB |
pwm-atmel-hlcdc.c | -rw-r--r-- | 8.0 KB |
pwm-atmel-tcb.c | -rw-r--r-- | 11.7 KB |
pwm-atmel.c | -rw-r--r-- | 10.4 KB |
pwm-bcm-iproc.c | -rw-r--r-- | 7.5 KB |
pwm-bcm-kona.c | -rw-r--r-- | 9.5 KB |
pwm-bcm2835.c | -rw-r--r-- | 5.0 KB |
pwm-berlin.c | -rw-r--r-- | 7.3 KB |
pwm-bfin.c | -rw-r--r-- | 3.1 KB |
pwm-brcmstb.c | -rw-r--r-- | 8.3 KB |
pwm-clps711x.c | -rw-r--r-- | 4.3 KB |
pwm-crc.c | -rw-r--r-- | 3.6 KB |
pwm-cros-ec.c | -rw-r--r-- | 6.0 KB |
pwm-ep93xx.c | -rw-r--r-- | 5.8 KB |
pwm-fsl-ftm.c | -rw-r--r-- | 12.2 KB |
pwm-hibvt.c | -rw-r--r-- | 7.2 KB |
pwm-img.c | -rw-r--r-- | 8.0 KB |
pwm-imx.c | -rw-r--r-- | 8.2 KB |
pwm-jz4740.c | -rw-r--r-- | 4.2 KB |
pwm-lp3943.c | -rw-r--r-- | 7.5 KB |
pwm-lpc18xx-sct.c | -rw-r--r-- | 13.6 KB |
pwm-lpc32xx.c | -rw-r--r-- | 4.4 KB |
pwm-lpss-pci.c | -rw-r--r-- | 3.2 KB |
pwm-lpss-platform.c | -rw-r--r-- | 2.3 KB |
pwm-lpss.c | -rw-r--r-- | 5.8 KB |
pwm-lpss.h | -rw-r--r-- | 776 bytes |
pwm-mediatek.c | -rw-r--r-- | 4.9 KB |
pwm-meson.c | -rw-r--r-- | 14.0 KB |
pwm-mtk-disp.c | -rw-r--r-- | 7.2 KB |
pwm-mxs.c | -rw-r--r-- | 4.7 KB |
pwm-omap-dmtimer.c | -rw-r--r-- | 10.3 KB |
pwm-pca9685.c | -rw-r--r-- | 14.4 KB |
pwm-puv3.c | -rw-r--r-- | 3.5 KB |
pwm-pxa.c | -rw-r--r-- | 5.5 KB |
pwm-rcar.c | -rw-r--r-- | 6.6 KB |
pwm-renesas-tpu.c | -rw-r--r-- | 11.9 KB |
pwm-rockchip.c | -rw-r--r-- | 10.1 KB |
pwm-samsung.c | -rw-r--r-- | 16.9 KB |
pwm-spear.c | -rw-r--r-- | 6.5 KB |
pwm-sti.c | -rw-r--r-- | 16.6 KB |
pwm-stm32.c | -rw-r--r-- | 8.9 KB |
pwm-stmpe.c | -rw-r--r-- | 7.2 KB |
pwm-sun4i.c | -rw-r--r-- | 10.3 KB |
pwm-tegra.c | -rw-r--r-- | 7.7 KB |
pwm-tiecap.c | -rw-r--r-- | 8.1 KB |
pwm-tiehrpwm.c | -rw-r--r-- | 15.7 KB |
pwm-tipwmss.c | -rw-r--r-- | 1.6 KB |
pwm-twl-led.c | -rw-r--r-- | 8.6 KB |
pwm-twl.c | -rw-r--r-- | 9.3 KB |
pwm-vt8500.c | -rw-r--r-- | 6.8 KB |
sysfs.c | -rw-r--r-- | 9.4 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...