mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
d0f8330652
Although we've covered the races between concurrent write() and ioctl() in the previous patch series, there is still a possible UAF in the following scenario: A: user client closed B: timer irq -> snd_seq_release() -> snd_seq_timer_interrupt() -> snd_seq_free_client() -> snd_seq_check_queue() -> cell = snd_seq_prioq_cell_peek() -> snd_seq_prioq_leave() .... removing all cells -> snd_seq_pool_done() .... vfree() -> snd_seq_compare_tick_time(cell) ... Oops So the problem is that a cell is peeked and accessed without any protection until it's retrieved from the queue again via snd_seq_prioq_cell_out(). This patch tries to address it, also cleans up the code by a slight refactoring. snd_seq_prioq_cell_out() now receives an extra pointer argument. When it's non-NULL, the function checks the event timestamp with the given pointer. The caller needs to pass the right reference either to snd_seq_tick or snd_seq_realtime depending on the event timestamp type. A good news is that the above change allows us to remove the snd_seq_prioq_cell_peek(), too, thus the patch actually reduces the code size. Reviewed-by: Nicolai Stange <nstange@suse.de> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
---|---|---|
.. | ||
oss | ||
seq | ||
compress_offload.c | ||
control.c | ||
control_compat.c | ||
ctljack.c | ||
device.c | ||
hrtimer.c | ||
hwdep.c | ||
hwdep_compat.c | ||
info.c | ||
info_oss.c | ||
init.c | ||
isadma.c | ||
jack.c | ||
Kconfig | ||
Makefile | ||
memalloc.c | ||
memory.c | ||
misc.c | ||
pcm.c | ||
pcm_compat.c | ||
pcm_dmaengine.c | ||
pcm_drm_eld.c | ||
pcm_iec958.c | ||
pcm_lib.c | ||
pcm_local.h | ||
pcm_memory.c | ||
pcm_misc.c | ||
pcm_native.c | ||
pcm_param_trace.h | ||
pcm_timer.c | ||
pcm_trace.h | ||
rawmidi.c | ||
rawmidi_compat.c | ||
seq_device.c | ||
sgbuf.c | ||
sound.c | ||
sound_oss.c | ||
timer.c | ||
timer_compat.c | ||
vmaster.c |