forked from Minki/linux
ALSA: pcm: prevent UAF in snd_pcm_info
When the device descriptor is closed, the `substream->runtime` pointer is freed. But another thread may be in the ioctl handler, case SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which calls snd_pcm_info() which accesses the now freed `substream->runtime`. Note: this fixes CVE-2017-0861 Signed-off-by: Robb Glasser <rglasser@google.com> Signed-off-by: Nick Desaulniers <ndesaulniers@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
parent
f429e7e494
commit
362bca57f5
@ -153,7 +153,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card,
|
||||
err = -ENXIO;
|
||||
goto _error;
|
||||
}
|
||||
mutex_lock(&pcm->open_mutex);
|
||||
err = snd_pcm_info_user(substream, info);
|
||||
mutex_unlock(&pcm->open_mutex);
|
||||
_error:
|
||||
mutex_unlock(®ister_mutex);
|
||||
return err;
|
||||
|
Loading…
Reference in New Issue
Block a user