brain-hackers_pepepper-mirror/linux-brain
1
0
Fork 0
mirror of https://github.com/brain-hackers/linux-brain.git synced 2024-06-09 23:36:23 +09:00
Code Issues Projects Releases Wiki Activity
4.14.x+fslc
linux-brain/sound/core
History
Takashi Iwai 7466294dad ALSA: seq: Fix racy pool initializations 
commit d15d662e89 upstream.

ALSA sequencer core initializes the event pool on demand by invoking
snd_seq_pool_init() when the first write happens and the pool is
empty.  Meanwhile user can reset the pool size manually via ioctl
concurrently, and this may lead to UAF or out-of-bound accesses since
the function tries to vmalloc / vfree the buffer.

A simple fix is to just wrap the snd_seq_pool_init() call with the
recently introduced client->ioctl_mutex; as the calls for
snd_seq_pool_init() from other side are always protected with this
mutex, we can avoid the race.

Reported-by: 范龙飞 <long7573@126.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-22 15:42:31 +01:00
..
oss ALSA: pcm: Allow aborting mutex lock at OSS read/write loops 2018-01-17 09:45:20 +01:00
seq ALSA: seq: Fix racy pool initializations 2018-02-22 15:42:31 +01:00
compress_offload.c ALSA: compress: Remove unused variable 2017-09-18 15:45:01 +02:00
control_compat.c ALSA: Get rid of card power_lock 2017-08-30 20:44:29 +02:00
control.c ALSA: Get rid of card power_lock 2017-08-30 20:44:29 +02:00
ctljack.c ALSA: declare snd_kcontrol_new structures as const 2017-05-30 10:29:25 +02:00
device.c ALSA: core: Use %pS printk format for direct addresses 2017-09-07 10:36:02 +02:00
hrtimer.c ALSA: timer: Limit max instances per timer 2017-11-06 10:41:24 +01:00
hwdep_compat.c [PATCH] hwdep_compat missed __user annotations 2006-10-10 15:37:21 -07:00
hwdep.c sched/wait: Rename wait_queue_t => wait_queue_entry_t 2017-06-20 12:18:27 +02:00
info_oss.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
info.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
init.c ALSA: Get rid of card power_lock 2017-08-30 20:44:29 +02:00
isadma.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
jack.c ALSA: jack: Allow building the jack layer without input device 2016-02-23 09:03:07 +01:00
Kconfig ALSA: seq: Allow the modular sequencer registration 2017-06-12 08:43:33 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
memalloc.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
memory.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
misc.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
pcm_compat.c ALSA: pcm: Fix structure definition for X32 ABI 2017-09-22 11:23:48 +02:00
pcm_dmaengine.c ASoC: dmaengine_pcm: Add support for packed transfers 2016-04-27 17:34:11 +01:00
pcm_drm_eld.c ALSA: pcm: use helper function to refer parameter as read-only 2017-05-17 07:24:39 +02:00
pcm_iec958.c ALSA: pcm: Allow 32 bit sample format in IEC958 channel status helper 2016-04-06 14:33:38 -07:00
pcm_lib.c ALSA: pcm: Remove yet superfluous WARN_ON() 2018-01-23 19:58:11 +01:00
pcm_local.h ALSA: pcm: unify codes to operate application-side position on PCM buffer 2017-06-12 08:49:22 +02:00
pcm_memory.c ALSA: pcm: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:18:58 +02:00
pcm_misc.c ALSA: pcm: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:18:58 +02:00
pcm_native.c ALSA: pcm: Workaround for weird PulseAudio behavior on rewind error 2018-01-17 09:45:19 +01:00
pcm_param_trace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pcm_timer.c ALSA: pcm: include pcm_local.h and remove some extraneous tabs 2017-05-30 18:04:47 +02:00
pcm_trace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pcm.c ALSA: pcm: prevent UAF in snd_pcm_info 2017-12-14 09:52:54 +01:00
rawmidi_compat.c ALSA: rawmidi: Fix ioctls X32 ABI 2016-02-28 17:44:51 +01:00
rawmidi.c ALSA: rawmidi: Avoid racy info ioctl via ctl device 2017-12-29 17:53:46 +01:00
seq_device.c ALSA: seq: Cancel pending autoload work at unbinding device 2017-09-12 12:41:20 +02:00
sgbuf.c ALSA: core: Deletion of unnecessary checks before two function calls 2014-11-21 20:06:57 +01:00
sound_oss.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
sound.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
timer_compat.c ALSA: timer: Remove kernel warning at compat ioctl error paths 2017-11-30 08:40:48 +00:00
timer.c ALSA: timer: Limit max instances per timer 2017-11-06 10:41:24 +01:00
vmaster.c ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization 2017-11-30 08:40:49 +00:00