mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-11-01 00:48:50 +00:00
c1f6e3c818
The rawmidi core allows user to resize the runtime buffer via ioctl, and this may lead to UAF when performed during concurrent reads or writes: the read/write functions unlock the runtime lock temporarily during copying form/to user-space, and that's the race window. This patch fixes the hole by introducing a reference counter for the runtime buffer read/write access and returns -EBUSY error when the resize is performed concurrently against read/write. Note that the ref count field is a simple integer instead of refcount_t here, since the all contexts accessing the buffer is basically protected with a spinlock, hence we need no expensive atomic ops. Also, note that this busy check is needed only against read / write functions, and not in receive/transmit callbacks; the race can happen only at the spinlock hole mentioned in the above, while the whole function is protected for receive / transmit callbacks. Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/CAFcO6XMWpUVK_yzzCpp8_XP7+=oUpQvuBeCbMffEDkpe8jWrfg@mail.gmail.com Link: https://lore.kernel.org/r/s5heerw3r5z.wl-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|---|---|---|
| .. | ||
| ac97 | ||
| sof | ||
| ac97_codec.h | ||
| aci.h | ||
| ad1816a.h | ||
| ad1843.h | ||
| adau1373.h | ||
| ak4xxx-adda.h | ||
| ak4113.h | ||
| ak4114.h | ||
| ak4117.h | ||
| ak4531_codec.h | ||
| ak4641.h | ||
| alc5623.h | ||
| asequencer.h | ||
| asound.h | ||
| asoundef.h | ||
| compress_driver.h | ||
| control.h | ||
| core.h | ||
| cs35l33.h | ||
| cs35l34.h | ||
| cs35l35.h | ||
| cs35l36.h | ||
| cs42l52.h | ||
| cs42l56.h | ||
| cs42l73.h | ||
| cs4231-regs.h | ||
| cs4271.h | ||
| cs8403.h | ||
| cs8427.h | ||
| da7213.h | ||
| da7218.h | ||
| da7219-aad.h | ||
| da7219.h | ||
| da9055.h | ||
| designware_i2s.h | ||
| dmaengine_pcm.h | ||
| emu10k1.h | ||
| emu10k1_synth.h | ||
| emu8000.h | ||
| emu8000_reg.h | ||
| emux_legacy.h | ||
| emux_synth.h | ||
| es1688.h | ||
| gus.h | ||
| hda_chmap.h | ||
| hda_codec.h | ||
| hda_component.h | ||
| hda_hwdep.h | ||
| hda_i915.h | ||
| hda_register.h | ||
| hda_regmap.h | ||
| hda_verbs.h | ||
| hdaudio.h | ||
| hdaudio_ext.h | ||
| hdmi-codec.h | ||
| hwdep.h | ||
| i2c.h | ||
| info.h | ||
| initval.h | ||
| intel-dsp-config.h | ||
| intel-nhlt.h | ||
| jack.h | ||
| l3.h | ||
| madera-pdata.h | ||
| max9768.h | ||
| max98088.h | ||
| max98090.h | ||
| max98095.h | ||
| memalloc.h | ||
| minors.h | ||
| mixer_oss.h | ||
| mpu401.h | ||
| omap-hdmi-audio.h | ||
| opl3.h | ||
| opl4.h | ||
| pcm-indirect.h | ||
| pcm.h | ||
| pcm_drm_eld.h | ||
| pcm_iec958.h | ||
| pcm_oss.h | ||
| pcm_params.h | ||
| pt2258.h | ||
| pxa2xx-lib.h | ||
| rawmidi.h | ||
| rt286.h | ||
| rt298.h | ||
| rt5514.h | ||
| rt5645.h | ||
| rt5659.h | ||
| rt5660.h | ||
| rt5663.h | ||
| rt5665.h | ||
| rt5668.h | ||
| rt5670.h | ||
| rt5682.h | ||
| s3c24xx_uda134x.h | ||
| sb.h | ||
| sb16_csp.h | ||
| seq_device.h | ||
| seq_kernel.h | ||
| seq_midi_emul.h | ||
| seq_midi_event.h | ||
| seq_oss.h | ||
| seq_oss_legacy.h | ||
| seq_virmidi.h | ||
| sh_dac_audio.h | ||
| sh_fsi.h | ||
| simple_card.h | ||
| simple_card_utils.h | ||
| snd_wavefront.h | ||
| soc-acpi-intel-match.h | ||
| soc-acpi.h | ||
| soc-component.h | ||
| soc-dai.h | ||
| soc-dapm.h | ||
| soc-dpcm.h | ||
| soc-topology.h | ||
| soc.h | ||
| sof.h | ||
| soundfont.h | ||
| spear_dma.h | ||
| spear_spdif.h | ||
| sta32x.h | ||
| sta350.h | ||
| tas2552-plat.h | ||
| tas5086.h | ||
| tea6330t.h | ||
| timer.h | ||
| tlv.h | ||
| tlv320aic3x.h | ||
| tlv320aic32x4.h | ||
| tlv320dac33-plat.h | ||
| tpa6130a2-plat.h | ||
| uda134x.h | ||
| uda1380.h | ||
| util_mem.h | ||
| vx_core.h | ||
| wavefront.h | ||
| wm0010.h | ||
| wm1250-ev1.h | ||
| wm2000.h | ||
| wm2200.h | ||
| wm5100.h | ||
| wm8903.h | ||
| wm8904.h | ||
| wm8955.h | ||
| wm8960.h | ||
| wm8962.h | ||
| wm8993.h | ||
| wm8996.h | ||
| wm9081.h | ||
| wm9090.h | ||
| wss.h | ||