linux/sound/core/seq
Takashi Iwai 3567eb6af6 ALSA: seq: Fix race at timer setup and close
ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client.  This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.

This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-01-12 17:50:41 +01:00
..
oss ALSA: Fix compat_ioctl handling for OSS emulations 2015-12-03 17:40:21 +01:00
Kconfig
Makefile ALSA: core: Fix randconfig build wrt CONFIG_PROC_FS 2015-05-29 07:21:02 +02:00
seq_clientmgr.c ALSA: seq: Fix missing NULL check at remove_events ioctl 2016-01-12 17:21:48 +01:00
seq_clientmgr.h
seq_compat.c
seq_device.c ALSA: core: Fix randconfig build wrt CONFIG_PROC_FS 2015-05-29 07:21:02 +02:00
seq_dummy.c ALSA: seq: Drop snd_seq_autoload_lock() and _unlock() 2015-02-12 14:42:31 +01:00
seq_fifo.c ALSA: seq: Drop superfluous error/debug messages after malloc failures 2015-03-10 15:41:18 +01:00
seq_fifo.h
seq_info.c ALSA: core: Build conditionally and remove superfluous ifdefs 2015-04-24 17:31:07 +02:00
seq_info.h ALSA: replace CONFIG_PROC_FS with CONFIG_SND_PROC_FS 2015-05-27 21:25:19 +02:00
seq_lock.c ALSA: seq: Use standard printk helpers 2014-02-14 08:14:18 +01:00
seq_lock.h
seq_memory.c ALSA: seq: Drop superfluous error/debug messages after malloc failures 2015-03-10 15:41:18 +01:00
seq_memory.h
seq_midi_emul.c ALSA: seq: potential out of bounds in do_control() 2015-02-12 11:07:48 +01:00
seq_midi_event.c sound: Add module.h to the previously silent sound users 2011-10-31 19:31:21 -04:00
seq_midi.c ALSA: seq: Drop snd_seq_autoload_lock() and _unlock() 2015-02-12 14:42:31 +01:00
seq_ports.c ALSA: seq: Drop superfluous error/debug messages after malloc failures 2015-03-10 15:41:18 +01:00
seq_ports.h ALSA: seq: remove unused callback_all field 2015-01-26 13:56:58 +01:00
seq_prioq.c ALSA: seq: Drop superfluous error/debug messages after malloc failures 2015-03-10 15:41:18 +01:00
seq_prioq.h
seq_queue.c ALSA: seq: Fix race at timer setup and close 2016-01-12 17:50:41 +01:00
seq_queue.h
seq_system.c sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed 2011-10-31 19:31:22 -04:00
seq_system.h
seq_timer.c ALSA: replace CONFIG_PROC_FS with CONFIG_SND_PROC_FS 2015-05-27 21:25:19 +02:00
seq_timer.h
seq_virmidi.c ALSA: midi: constify snd_rawmidi_global_ops structures 2015-11-22 09:21:16 +01:00
seq.c Subject: ALSA: seq: Remove autoload locks in driver registration 2014-10-18 20:25:19 +02:00