]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
ALSA: seq: Fix racy access for queue timer in proc read
authorTakashi Iwai <tiwai@suse.de>
Wed, 15 Jan 2020 20:37:33 +0000 (21:37 +0100)
committerKhalid Elmously <khalid.elmously@canonical.com>
Fri, 14 Feb 2020 05:29:37 +0000 (00:29 -0500)
commit43cdcecf3a1bd5fdf9cbce0f3908cdde789c7ffd
tree874ccd92e1288c4139df16fb02bdc58dfa5312e0
parentce3c68bb395f78d57bb7ec6b219dcee7b17b8e43
ALSA: seq: Fix racy access for queue timer in proc read

BugLink: https://bugs.launchpad.net/bugs/1862259
commit 60adcfde92fa40fcb2dbf7cc52f9b096e0cd109a upstream.

snd_seq_info_timer_read() reads the information of the timer assigned
for each queue, but it's done in a racy way which may lead to UAF as
spotted by syzkaller.

This patch applies the missing q->timer_mutex lock while accessing the
timer object as well as a slight code change to adapt the standard
coding style.

Reported-by: syzbot+2b2ef983f973e5c40943@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200115203733.26530-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
sound/core/seq/seq_timer.c