mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-16 07:35:14 +00:00
Code Issues Releases Wiki Activity
linux-stable/sound/core
History
Takashi Iwai 20f2e4c228 ALSA: seq: Fix racy access for queue timer in proc read 
commit 60adcfde92 upstream.

snd_seq_info_timer_read() reads the information of the timer assigned
for each queue, but it's done in a racy way which may lead to UAF as
spotted by syzkaller.

This patch applies the missing q->timer_mutex lock while accessing the
timer object as well as a slight code change to adapt the standard
coding style.

Reported-by: syzbot+2b2ef983f973e5c40943@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200115203733.26530-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:21:28 +01:00
..
oss ALSA: pcm: oss: Avoid potential buffer overflows 2019-12-13 08:52:37 +01:00
seq ALSA: seq: Fix racy access for queue timer in proc read 2020-01-23 08:21:28 +01:00
compress_offload.c ASoC: compress: fix unsigned integer overflow check 2019-12-05 09:19:35 +01:00
control.c ALSA: control: Fix race between adding and removing a user element 2018-12-05 19:32:08 +01:00
control_compat.c ALSA: control: fix a redundant-copy issue 2018-05-13 09:27:57 +02:00
ctljack.c ALSA: declare snd_kcontrol_new structures as const 2017-05-30 10:29:25 +02:00
device.c ALSA: core: Assure control device to be registered at last 2018-05-17 08:21:23 +02:00
hrtimer.c Merge branch 'for-next' into for-linus 2017-11-13 15:43:13 +01:00
hwdep.c Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-01-31 09:25:20 -08:00
hwdep_compat.c
info.c ALSA: info: Fix racy addition/deletion of nodes 2019-04-27 09:36:40 +02:00
info_oss.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
init.c ALSA: core: Fix card races between register and disconnect 2019-04-27 09:36:36 +02:00
isadma.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
jack.c ALSA: fix kernel-doc build warning 2017-10-30 08:10:07 +01:00
Kconfig docs: Fix some broken references 2018-06-15 18:10:01 -03:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
memalloc.c ALSA: memalloc: Don't exceed over the requested size 2018-07-23 09:06:33 +02:00
memory.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
misc.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
pcm.c ALSA: pcm: Fix potential Spectre v1 vulnerability 2019-01-09 17:38:36 +01:00
pcm_compat.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
pcm_dmaengine.c ASoC: dmaengine_pcm: Add support for packed transfers 2016-04-27 17:34:11 +01:00
pcm_drm_eld.c ALSA: pcm: use helper function to refer parameter as read-only 2017-05-17 07:24:39 +02:00
pcm_iec958.c ALSA: pcm: Allow 32 bit sample format in IEC958 channel status helper 2016-04-06 14:33:38 -07:00
pcm_lib.c ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() 2019-12-13 08:51:05 +01:00
pcm_local.h ALSA: pcm: trace XRUN event at injection, too 2018-07-04 15:34:57 +02:00
pcm_memory.c sound: Use octal not symbolic permissions 2018-05-28 11:27:20 +02:00
pcm_misc.c ALSA: pcm: add SNDRV_PCM_FORMAT_{S,U}20 2017-11-29 09:26:33 +01:00
pcm_native.c ALSA: pcm: Avoid possible info leaks from PCM stream buffers 2019-12-31 16:34:45 +01:00
pcm_param_trace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pcm_timer.c ALSA: pcm: include pcm_local.h and remove some extraneous tabs 2017-05-30 18:04:47 +02:00
pcm_trace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rawmidi.c ALSA: rawmidi: Fix potential Spectre v1 vulnerability 2019-04-03 06:26:22 +02:00
rawmidi_compat.c ALSA: rawmidi: Fix missing input substream checks in compat ioctls 2018-04-19 18:16:15 +02:00
seq_device.c ALSA: seq: Cancel pending autoload work at unbinding device 2017-09-12 12:41:20 +02:00
sgbuf.c ALSA: core: Deletion of unnecessary checks before two function calls 2014-11-21 20:06:57 +01:00
sound.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
sound_oss.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
timer.c ALSA: timer: Limit max amount of slave instances 2019-12-31 16:35:40 +01:00
timer_compat.c ALSA: timer: Remove kernel warning at compat ioctl error paths 2017-11-21 16:36:11 +01:00
vmaster.c - Introduce arithmetic overflow test helper functions (Rasmus) 2018-06-06 17:27:14 -07:00