lkml.org 
[lkml]   [2016]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.2.y-ckt 110/268] ALSA: seq: Fix race at timer setup and close
    Date
    4.2.8-ckt3 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Takashi Iwai <tiwai@suse.de>

    commit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream.

    ALSA sequencer code has an open race between the timer setup ioctl and
    the close of the client. This was triggered by syzkaller fuzzer, and
    a use-after-free was caught there as a result.

    This patch papers over it by adding a proper queue->timer_mutex lock
    around the timer-related calls in the relevant code path.

    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Tested-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    sound/core/seq/seq_queue.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
    index 7dfd0f4..0bec02e 100644
    --- a/sound/core/seq/seq_queue.c
    +++ b/sound/core/seq/seq_queue.c
    @@ -142,8 +142,10 @@ static struct snd_seq_queue *queue_new(int owner, int locked)
    static void queue_delete(struct snd_seq_queue *q)
    {
    /* stop and release the timer */
    + mutex_lock(&q->timer_mutex);
    snd_seq_timer_stop(q->timer);
    snd_seq_timer_close(q);
    + mutex_unlock(&q->timer_mutex);
    /* wait until access free */
    snd_use_lock_sync(&q->use_lock);
    /* release resources... */
    --
    1.9.1
    \
     
     \ /
      Last update: 2016-01-27 23:01    [W:4.162 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site