Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1319406

[PATCH 4.3 052/157] ALSA: seq: Fix race at timer setup and close

Show all headers | View raw

4.3-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream.

ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client.  This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.

This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/seq/seq_queue.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -142,8 +142,10 @@ static struct snd_seq_queue *queue_new(i
 static void queue_delete(struct snd_seq_queue *q)
 {
 	/* stop and release the timer */
+	mutex_lock(&q->timer_mutex);
 	snd_seq_timer_stop(q->timer);
 	snd_seq_timer_close(q);
+	mutex_unlock(&q->timer_mutex);
 	/* wait until access free */
 	snd_use_lock_sync(&q->use_lock);
 	/* release resources... */

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.3 000/157] 4.3.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
  [PATCH 4.3 001/157] x86 smpboot: Re-enable init_udelay=0 by default on modern CPUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
  [PATCH 4.3 052/157] ALSA: seq: Fix race at timer setup and close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
  [PATCH 4.3 046/157] ALSA: hda - Add mic mute hotkey quirk for Lenovo ThinkCentre AIO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
  [PATCH 4.3 010/157] KVM: svm: unconditionally intercept #DB Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
  [PATCH 4.3 155/157] mn10300: Select CONFIG_HAVE_UID16 to fix build failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:10 +0100
  [PATCH 4.3 154/157] fix the regression from "direct-io: Fix negative return from dio read beyond eof" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:20 +0100
  [PATCH 4.3 126/157] powerpc/opal-irqchip: Fix deadlock introduced by "Fix double endian conversion" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:20 +0100
  [PATCH 4.3 135/157] arm64: cmpxchg_dbl: fix return value type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:20 +0100
  [PATCH 4.3 134/157] arm64: bpf: fix mod-by-zero case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:20 +0100
  [PATCH 4.3 044/157] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 128/157] powerpc: Make value-returning atomics fully ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 157/157] arm64: KVM: Add workaround for Cortex-A57 erratum 834220 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 131/157] powerpc/module: Handle R_PPC64_ENTRY relocations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 129/157] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 133/157] arm64: bpf: fix div-by-zero case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 156/157] arm64: restore bogomips information in /proc/cpuinfo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 147/157] parisc iommu: fix panic due to trying to allocate too large region Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 132/157] recordmcount: arm64: Replace the ignored mcount call into nop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 148/157] HID: wacom: Tie cached HID_DG_CONTACTCOUNT indices to report ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 150/157] HID: core: Avoid uninitialized buffer access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 149/157] HID: wacom: Expect touch_max touches if HID_DG_CONTACTCOUNT not present Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 130/157] scripts/recordmcount.pl: support data in text section on powerpc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100
  [PATCH 4.3 153/157] direct-io: Fix negative return from dio read beyond eof Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:30 +0100

csiph-web