lkml.org 
[lkml]   [2017]   [Dec]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 018/105] ALSA: pcm: prevent UAF in snd_pcm_info
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Robb Glasser <rglasser@google.com>

    commit 362bca57f5d78220f8b5907b875961af9436e229 upstream.

    When the device descriptor is closed, the `substream->runtime` pointer
    is freed. But another thread may be in the ioctl handler, case
    SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
    calls snd_pcm_info() which accesses the now freed `substream->runtime`.

    Note: this fixes CVE-2017-0861

    Signed-off-by: Robb Glasser <rglasser@google.com>
    Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/core/pcm.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/sound/core/pcm.c
    +++ b/sound/core/pcm.c
    @@ -149,7 +149,9 @@ static int snd_pcm_control_ioctl(struct
    err = -ENXIO;
    goto _error;
    }
    + mutex_lock(&pcm->open_mutex);
    err = snd_pcm_info_user(substream, info);
    + mutex_unlock(&pcm->open_mutex);
    _error:
    mutex_unlock(&register_mutex);
    return err;

    \
     
     \ /
      Last update: 2017-12-15 11:46    [W:4.033 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site