diff options
| author | Robb Glasser <rglasser@google.com> | 2017-12-05 09:16:55 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-12-16 10:33:48 +0100 |
| commit | 659e7d2588f0fd970044fe00d9edeb482d375288 (patch) | |
| tree | ef506327bd44b88ff54fa98e31aa13b8b13678f2 /sound/core/rawmidi.c | |
| parent | 5986c9685f1e53c20e6a5ddd9f39020d8634fc62 (diff) | |
ALSA: pcm: prevent UAF in snd_pcm_info
commit 362bca57f5d78220f8b5907b875961af9436e229 upstream.
When the device descriptor is closed, the `substream->runtime` pointer
is freed. But another thread may be in the ioctl handler, case
SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
calls snd_pcm_info() which accesses the now freed `substream->runtime`.
Note: this fixes CVE-2017-0861
Signed-off-by: Robb Glasser <rglasser@google.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'sound/core/rawmidi.c')
0 files changed, 0 insertions, 0 deletions