diff options
| author | Takashi Iwai <[email protected]> | 2019-04-09 16:04:17 +0000 |
|---|---|---|
| committer | Takashi Iwai <[email protected]> | 2019-04-09 16:54:13 +0000 |
| commit | 2eabc5ec8ab4d4748a82050dfcb994119b983750 (patch) | |
| tree | 13103ccf8a6c0f07e9200403fcd26a30b30200c6 /sound/core/timer.c | |
| parent | ALSA: seq: Protect in-kernel ioctl calls with mutex (diff) | |
| download | kernel-2eabc5ec8ab4d4748a82050dfcb994119b983750.tar.gz kernel-2eabc5ec8ab4d4748a82050dfcb994119b983750.zip | |
ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
The snd_seq_ioctl_get_subscription() retrieves the port subscriber
information as a pointer, while the object isn't protected, hence it
may be deleted before the actual reference. This race was spotted by
syzkaller and may lead to a UAF.
The fix is simply copying the data in the lookup function that
performs in the rwsem to protect against the deletion.
Reported-by: [email protected]
Signed-off-by: Takashi Iwai <[email protected]>
Diffstat (limited to 'sound/core/timer.c')
0 files changed, 0 insertions, 0 deletions