diff options
| author | Takashi Iwai <tiwai@suse.de> | 2017-02-08 12:35:39 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-02-14 15:22:52 -0800 |
| commit | e5f20a3fd6dbdc3db409aa786899e60754562e1a (patch) | |
| tree | 772f217649ae0e903ca034c4e08953ce9a1bf1b5 /net/lapb/lapb_subr.c | |
| parent | 010ada0cfcb9743f141ee7d7a22df063786129da (diff) | |
ALSA: seq: Fix race at creating a queue
commit 4842e98f26dd80be3623c4714a244ba52ea096a8 upstream.
When a sequencer queue is created in snd_seq_queue_alloc(),it adds the
new queue element to the public list before referencing it. Thus the
queue might be deleted before the call of snd_seq_queue_use(), and it
results in the use-after-free error, as spotted by syzkaller.
The fix is to reference the queue object at the right time.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/lapb/lapb_subr.c')
0 files changed, 0 insertions, 0 deletions