Revision 7e1d90f60a0d501c8503e636942ca704a454d910 authored by Daniel Mentz on 14 August 2017, 21:46:01 UTC, committed by Takashi Iwai on 15 August 2017, 06:02:35 UTC
commit 4842e98f26dd80be3623c4714a244ba52ea096a8 ("ALSA: seq: Fix race at creating a queue") attempted to fix a race reported by syzkaller. That fix has been described as follows: " When a sequencer queue is created in snd_seq_queue_alloc(),it adds the new queue element to the public list before referencing it. Thus the queue might be deleted before the call of snd_seq_queue_use(), and it results in the use-after-free error, as spotted by syzkaller. The fix is to reference the queue object at the right time. " Even with that fix in place, syzkaller reported a use-after-free error. It specifically pointed to the last instruction "return q->queue" in snd_seq_queue_alloc(). The pointer q is being used after kfree() has been called on it. It turned out that there is still a small window where a race can happen. The window opens at snd_seq_ioctl_create_queue()->snd_seq_queue_alloc()->queue_list_add() and closes at snd_seq_ioctl_create_queue()->queueptr()->snd_use_lock_use(). Between these two calls, a different thread could delete the queue and possibly re-create a different queue in the same location in queue_list. This change prevents this situation by calling snd_use_lock_use() from snd_seq_queue_alloc() prior to calling queue_list_add(). It is then the caller's responsibility to call snd_use_lock_free(&q->use_lock). Fixes: 4842e98f26dd ("ALSA: seq: Fix race at creating a queue") Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Daniel Mentz <danielmentz@google.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent 8df4b00
File | Mode | Size |
---|---|---|
basic | ||
coccinelle | ||
dtc | ||
gcc-plugins | ||
gdb | ||
genksyms | ||
kconfig | ||
ksymoops | ||
mod | ||
package | ||
selinux | ||
tracing | ||
.gitignore | -rw-r--r-- | 162 bytes |
Kbuild.include | -rw-r--r-- | 15.2 KB |
Lindent | -rwxr-xr-x | 467 bytes |
Makefile | -rw-r--r-- | 1.6 KB |
Makefile.asm-generic | -rw-r--r-- | 1.1 KB |
Makefile.build | -rw-r--r-- | 18.9 KB |
Makefile.clean | -rw-r--r-- | 2.9 KB |
Makefile.dtbinst | -rw-r--r-- | 1.1 KB |
Makefile.extrawarn | -rw-r--r-- | 2.5 KB |
Makefile.fwinst | -rw-r--r-- | 2.0 KB |
Makefile.gcc-plugins | -rw-r--r-- | 3.4 KB |
Makefile.headersinst | -rw-r--r-- | 4.0 KB |
Makefile.help | -rw-r--r-- | 68 bytes |
Makefile.host | -rw-r--r-- | 6.6 KB |
Makefile.kasan | -rw-r--r-- | 1005 bytes |
Makefile.lib | -rw-r--r-- | 15.6 KB |
Makefile.modbuiltin | -rw-r--r-- | 1.8 KB |
Makefile.modinst | -rw-r--r-- | 1.2 KB |
Makefile.modpost | -rw-r--r-- | 5.5 KB |
Makefile.modsign | -rw-r--r-- | 1005 bytes |
Makefile.ubsan | -rw-r--r-- | 1.0 KB |
adjust_autoksyms.sh | -rwxr-xr-x | 2.8 KB |
asn1_compiler.c | -rw-r--r-- | 35.5 KB |
bloat-o-meter | -rwxr-xr-x | 2.2 KB |
bootgraph.pl | -rwxr-xr-x | 6.3 KB |
check_00index.sh | -rwxr-xr-x | 1.3 KB |
check_extable.sh | -rwxr-xr-x | 4.9 KB |
checkincludes.pl | -rwxr-xr-x | 1.9 KB |
checkkconfigsymbols.py | -rwxr-xr-x | 15.5 KB |
checkpatch.pl | -rwxr-xr-x | 186.9 KB |
checkstack.pl | -rwxr-xr-x | 5.4 KB |
checksyscalls.sh | -rwxr-xr-x | 5.6 KB |
checkversion.pl | -rwxr-xr-x | 1.9 KB |
cleanfile | -rwxr-xr-x | 3.4 KB |
cleanpatch | -rwxr-xr-x | 5.0 KB |
coccicheck | -rwxr-xr-x | 7.1 KB |
config | -rwxr-xr-x | 4.5 KB |
conmakehash.c | -rw-r--r-- | 6.0 KB |
const_structs.checkpatch | -rw-r--r-- | 964 bytes |
decode_stacktrace.sh | -rwxr-xr-x | 3.7 KB |
decodecode | -rwxr-xr-x | 2.1 KB |
depmod.sh | -rwxr-xr-x | 1.7 KB |
diffconfig | -rwxr-xr-x | 3.7 KB |
export_report.pl | -rwxr-xr-x | 4.5 KB |
extract-cert.c | -rw-r--r-- | 3.5 KB |
extract-ikconfig | -rwxr-xr-x | 1.7 KB |
extract-module-sig.pl | -rwxr-xr-x | 3.6 KB |
extract-sys-certs.pl | -rwxr-xr-x | 3.7 KB |
extract-vmlinux | -rwxr-xr-x | 1.6 KB |
extract_xc3028.pl | -rwxr-xr-x | 44.6 KB |
faddr2line | -rwxr-xr-x | 5.1 KB |
gcc-goto.sh | -rwxr-xr-x | 495 bytes |
gcc-ld | -rwxr-xr-x | 676 bytes |
gcc-plugin.sh | -rwxr-xr-x | 1.0 KB |
gcc-version.sh | -rwxr-xr-x | 822 bytes |
gcc-x86_32-has-stack-protector.sh | -rwxr-xr-x | 184 bytes |
gcc-x86_64-has-stack-protector.sh | -rwxr-xr-x | 209 bytes |
gen_initramfs_list.sh | -rwxr-xr-x | 8.0 KB |
get_dvb_firmware | -rwxr-xr-x | 25.2 KB |
get_maintainer.pl | -rwxr-xr-x | 59.2 KB |
gfp-translate | -rwxr-xr-x | 1.7 KB |
headerdep.pl | -rwxr-xr-x | 3.5 KB |
headers.sh | -rwxr-xr-x | 477 bytes |
headers_check.pl | -rwxr-xr-x | 3.7 KB |
headers_install.sh | -rwxr-xr-x | 1.3 KB |
insert-sys-cert.c | -rw-r--r-- | 8.9 KB |
kallsyms.c | -rw-r--r-- | 18.7 KB |
kernel-doc | -rwxr-xr-x | 91.7 KB |
ld-version.sh | -rwxr-xr-x | 234 bytes |
link-vmlinux.sh | -rwxr-xr-x | 7.7 KB |
makelst | -rwxr-xr-x | 773 bytes |
markup_oops.pl | -rwxr-xr-x | 8.1 KB |
mkcompile_h | -rwxr-xr-x | 2.5 KB |
mkmakefile | -rwxr-xr-x | 1.2 KB |
mksysmap | -rwxr-xr-x | 1.3 KB |
mkuboot.sh | -rwxr-xr-x | 379 bytes |
mkversion | -rw-r--r-- | 74 bytes |
module-common.lds | -rw-r--r-- | 901 bytes |
namespace.pl | -rwxr-xr-x | 13.0 KB |
objdiff | -rwxr-xr-x | 2.8 KB |
parse-maintainers.pl | -rw-r--r-- | 1.5 KB |
patch-kernel | -rwxr-xr-x | 9.9 KB |
pnmtologo.c | -rw-r--r-- | 11.9 KB |
profile2linkerlist.pl | -rwxr-xr-x | 379 bytes |
prune-kernel | -rwxr-xr-x | 673 bytes |
recordmcount.c | -rw-r--r-- | 17.2 KB |
recordmcount.h | -rw-r--r-- | 16.4 KB |
recordmcount.pl | -rwxr-xr-x | 18.0 KB |
setlocalversion | -rwxr-xr-x | 3.9 KB |
show_delta | -rwxr-xr-x | 3.0 KB |
sign-file.c | -rw-r--r-- | 9.8 KB |
sortextable.c | -rw-r--r-- | 8.4 KB |
sortextable.h | -rw-r--r-- | 5.5 KB |
spelling.txt | -rw-r--r-- | 24.2 KB |
stackdelta | -rwxr-xr-x | 1.8 KB |
stackusage | -rwxr-xr-x | 759 bytes |
tags.sh | -rwxr-xr-x | 9.5 KB |
unifdef.c | -rw-r--r-- | 34.8 KB |
ver_linux | -rwxr-xr-x | 2.9 KB |
xen-hypercalls.sh | -rw-r--r-- | 351 bytes |
xz_wrap.sh | -rwxr-xr-x | 562 bytes |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...