Skip to main content

Browse the archive

https://github.com/torvalds/linux
17 May 2024, 09:02:56 UTC
Revision 83e197a8414c0ba545e7e3916ce05f836f349273 authored by Takashi Iwai on 10 June 2021, 15:20:59 UTC, committed by Takashi Iwai on 10 June 2021, 15:21:30 UTC 
ALSA: seq: Fix race of snd_seq_timer_open()
 
The timer instance per queue is exclusive, and snd_seq_timer_open()
should have managed the concurrent accesses.  It looks as if it's
checking the already existing timer instance at the beginning, but
it's not right, because there is no protection, hence any later
concurrent call of snd_seq_timer_open() may override the timer
instance easily.  This may result in UAF, as the leftover timer
instance can keep running while the queue itself gets closed, as
spotted by syzkaller recently.

For avoiding the race, add a proper check at the assignment of
tmr->timeri again, and return -EBUSY if it's been already registered.

Reported-by: syzbot+ddc1260a83ed1cbf6fb5@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/000000000000dce34f05c42f110c@google.com
Link: https://lore.kernel.org/r/20210610152059.24633-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent a0309c3
History
Tip revision: 83e197a8414c0ba545e7e3916ce05f836f349273 authored by Takashi Iwai on 10 June 2021, 15:20:59 UTC
ALSA: seq: Fix race of snd_seq_timer_open()
Tip revision: 83e197a
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 16.4 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 71 bytes
.gitattributes -rw-r--r-- 62 bytes
.gitignore -rw-r--r-- 1.9 KB
.mailmap -rw-r--r-- 19.1 KB
COPYING -rw-r--r-- 496 bytes
CREDITS -rw-r--r-- 98.3 KB
Kbuild -rw-r--r-- 1.3 KB
Kconfig -rw-r--r-- 555 bytes
MAINTAINERS -rw-r--r-- 578.1 KB
Makefile -rw-r--r-- 64.7 KB
README -rw-r--r-- 727 bytes

README

back to top