lkml.org 
[lkml]   [2016]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 06/64] ALSA: seq: Fix race at timer setup and close
    Date
    From: Takashi Iwai <tiwai@suse.de>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream.

    ALSA sequencer code has an open race between the timer setup ioctl and
    the close of the client. This was triggered by syzkaller fuzzer, and
    a use-after-free was caught there as a result.

    This patch papers over it by adding a proper queue->timer_mutex lock
    around the timer-related calls in the relevant code path.

    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Tested-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    sound/core/seq/seq_queue.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
    index f9077361c119..4c9aa462de9b 100644
    --- a/sound/core/seq/seq_queue.c
    +++ b/sound/core/seq/seq_queue.c
    @@ -144,8 +144,10 @@ static struct snd_seq_queue *queue_new(int owner, int locked)
    static void queue_delete(struct snd_seq_queue *q)
    {
    /* stop and release the timer */
    + mutex_lock(&q->timer_mutex);
    snd_seq_timer_stop(q->timer);
    snd_seq_timer_close(q);
    + mutex_unlock(&q->timer_mutex);
    /* wait until access free */
    snd_use_lock_sync(&q->use_lock);
    /* release resources... */
    --
    2.7.1
    \
     
     \ /
      Last update: 2016-02-11 16:21    [W:3.344 / U:1.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site