Takashi Iwai 20f2e4c228 ALSA: seq: Fix racy access for queue timer in proc read ...

commit 60adcfde92fa40fcb2dbf7cc52f9b096e0cd109a upstream.

snd_seq_info_timer_read() reads the information of the timer assigned
for each queue, but it's done in a racy way which may lead to UAF as
spotted by syzkaller.

This patch applies the missing q->timer_mutex lock while accessing the
timer object as well as a slight code change to adapt the standard
coding style.

Reported-by: syzbot+2b2ef983f973e5c40943@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200115203733.26530-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2020-01-23 08:21:28 +01:00

..

oss

ALSA: seq: fix incorrect order of dest_client/dest_ports arguments

2019-07-10 09:53:42 +02:00

Kconfig

…

Makefile

…

seq_clientmgr.c

ALSA: seq: Fix potential concurrent access to the deleted pool

2019-09-06 10:22:09 +02:00

seq_clientmgr.h

…

seq_compat.c

…

seq_dummy.c

…

seq_fifo.c

ALSA: seq: Fix potential concurrent access to the deleted pool

2019-09-06 10:22:09 +02:00

seq_fifo.h

ALSA: seq: Fix potential concurrent access to the deleted pool

2019-09-06 10:22:09 +02:00

seq_info.c

ALSA: seq: Fix leftovers at probe error path

2018-08-01 22:54:36 +02:00

seq_info.h

ALSA: seq: Fix leftovers at probe error path

2018-08-01 22:54:36 +02:00

seq_lock.c

…

seq_lock.h

…

seq_memory.c

ALSA: seq: Remove dead codes

2018-08-01 22:54:35 +02:00

seq_memory.h

ALSA: seq: Remove dead codes

2018-08-01 22:54:35 +02:00

seq_midi_emul.c

ALSA: seq: Mark expected switch fall-through

2018-08-04 08:30:36 +02:00

seq_midi_event.c

ALSA: seq: Remove dead codes

2018-08-01 22:54:35 +02:00

seq_midi.c

…

seq_ports.c

ALSA: seq: Fix race of get-subscription call vs port-delete ioctls

2019-06-19 08:18:01 +02:00

seq_ports.h

ALSA: seq: Fix race of get-subscription call vs port-delete ioctls

2019-06-19 08:18:01 +02:00

seq_prioq.c

…

seq_prioq.h

…

seq_queue.c

ALSA: seq: Fix leftovers at probe error path

2018-08-01 22:54:36 +02:00

seq_queue.h

ALSA: seq: Drop unused 64bit division macros

2018-08-01 22:54:37 +02:00

seq_system.c

ALSA: seq: Do error checks at creating system ports

2019-11-20 18:45:27 +01:00

seq_system.h

…

seq_timer.c

ALSA: seq: Fix racy access for queue timer in proc read

2020-01-23 08:21:28 +01:00

seq_timer.h

…

seq_virmidi.c

ALSA: seq: virmidi: Fix discarding the unsubscribed output

2018-08-14 22:50:52 +02:00

seq.c

ALSA: seq: Fix leftovers at probe error path

2018-08-01 22:54:36 +02:00