]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ALSA: seq: Fix race during FIFO resize
authorTakashi Iwai <tiwai@suse.de>
Fri, 24 Mar 2017 16:07:57 +0000 (17:07 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 8 Apr 2017 07:35:06 +0000 (09:35 +0200)
commitc36ef6467420f8982e6d4d6f93d0634a85a5ee45
tree987ae2b477f05c870c57227a09e034fe66153240
parentd2e79b56ba2ea77dcac7f73a5b5f3f371a27b921
ALSA: seq: Fix race during FIFO resize

commit 2d7d54002e396c180db0c800c1046f0a3c471597 upstream.

When a new event is queued while processing to resize the FIFO in
snd_seq_fifo_clear(), it may lead to a use-after-free, as the old pool
that is being queued gets removed.  For avoiding this race, we need to
close the pool to be deleted and sync its usage before actually
deleting it.

The issue was spotted by syzkaller.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
sound/core/seq/seq_fifo.c