| commit | 8763ac70dd9f701380e87d527e63877229b9beda | |
| author | Takashi Iwai <tiwai@suse.de> | |
| Tue, 9 Apr 2019 16:04:17 +0000 (9 18:04 +0200) | ||
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| Sat, 22 Jun 2019 06:17:19 +0000 (22 08:17 +0200) | ||
| tree | d8e5e1908f71f21cf008257097e8c6750e65faf3 | treesnapshot (tar.gz zip) |
| parent | dcdbccdcbb13212f3cf6557db6c49a4782cbf5d2 | commitdiff |
ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
[ Upstream commit 2eabc5ec8ab4d4748a82050dfcb994119b983750 ]
The snd_seq_ioctl_get_subscription() retrieves the port subscriber
information as a pointer, while the object isn't protected, hence it
may be deleted before the actual reference. This race was spotted by
syzkaller and may lead to a UAF.
The fix is simply copying the data in the lookup function that
performs in the rwsem to protect against the deletion.
Reported-by: syzbot+9437020c82413d00222d@syzkaller.appspotmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 2eabc5ec8ab4d4748a82050dfcb994119b983750 ]
The snd_seq_ioctl_get_subscription() retrieves the port subscriber
information as a pointer, while the object isn't protected, hence it
may be deleted before the actual reference. This race was spotted by
syzkaller and may lead to a UAF.
The fix is simply copying the data in the lookup function that
performs in the rwsem to protect against the deletion.
Reported-by: syzbot+9437020c82413d00222d@syzkaller.appspotmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| sound/core/seq/seq_clientmgr.c | diffblobblamehistory | |
| sound/core/seq/seq_ports.c | diffblobblamehistory | |
| sound/core/seq/seq_ports.h | diffblobblamehistory |