linux_old1/sound/core
Takashi Iwai 3567eb6af6 ALSA: seq: Fix race at timer setup and close
ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client.  This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.

This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-01-12 17:50:41 +01:00
..
oss ALSA: oss: consolidate kmalloc/memset 0 call to kzalloc 2015-12-20 22:31:02 +01:00
seq ALSA: seq: Fix race at timer setup and close 2016-01-12 17:50:41 +01:00
Kconfig ALSA: timer: add config item to export PCM timer disabling for expert 2015-10-16 14:31:38 +02:00
Makefile ALSA: timer: add config item to export PCM timer disabling for expert 2015-10-16 14:31:38 +02:00
compress_offload.c ALSA: compress: add support for 32bit calls in a 64bit kernel 2015-12-07 10:44:48 +01:00
control.c ALSA: ctl: fix to handle several elements added by one operation for userspace element 2015-04-13 10:31:49 +02:00
control_compat.c ALSA: control: Use standard printk helpers 2014-02-14 08:14:14 +01:00
ctljack.c ALSA: jack: Fix endless loop at unique index detection 2015-06-26 06:59:57 +02:00
device.c Merge branch 'topic/hda-unbind' into for-next 2015-03-16 14:48:20 +01:00
hrtimer.c sound: Use hrtimer_resolution instead of hrtimer_get_res() 2015-04-22 17:06:48 +02:00
hwdep.c ALSA: replace CONFIG_PROC_FS with CONFIG_SND_PROC_FS 2015-05-27 21:25:19 +02:00
hwdep_compat.c [PATCH] hwdep_compat missed __user annotations 2006-10-10 15:37:21 -07:00
info.c ALSA: info: Drop kerneldoc comment from snd_info_create_entry() 2015-05-18 09:45:11 +02:00
info_oss.c ALSA: core: Clean up OSS proc file management 2015-04-24 17:31:08 +02:00
init.c ALSA: Fix uninintialized error return 2015-06-29 19:08:31 +02:00
isadma.c ALSA: core: Use standard printk helpers 2014-02-14 08:14:15 +01:00
jack.c ALSA: jack: Remove MODULE_*() macros 2015-05-21 11:32:51 +02:00
memalloc.c genalloc: rename of_get_named_gen_pool() to of_gen_pool_get() 2015-06-30 19:45:01 -07:00
memory.c ALSA: Include linux/uaccess.h and linux/bitopts.h instead of asm/* 2015-01-28 17:25:07 +01:00
misc.c ALSA: Allow pass NULL dev for snd_pci_quirk_lookup() 2014-10-08 12:08:38 +02:00
pcm.c ALSA: pcm: remove structure member of 'struct snd_pcm_hwptr_log *' type because this structure had been removed 2015-09-13 12:03:15 +02:00
pcm_compat.c ALSA: core: pass audio tstamp config from userspace in compat mode 2015-02-20 17:30:05 +01:00
pcm_dmaengine.c ALSA: Fix spelling typo in Documentation/DocBook/alsa-driver-api.xml 2015-03-04 12:12:59 +01:00
pcm_drm_eld.c ALSA: pcm: add DRM ELD helper 2015-05-22 16:01:44 +02:00
pcm_iec958.c ALSA: pcm: add IEC958 channel status helper 2015-05-22 16:01:47 +02:00
pcm_lib.c ALSA: Constify ratden/ratnum constraints 2015-10-28 11:42:22 +01:00
pcm_memory.c ALSA: Include linux/io.h instead of asm/io.h 2015-01-28 16:49:33 +01:00
pcm_misc.c ALSA: pcm: Add big-endian DSD sample formats and fix XMOS DSD sample format 2014-11-21 15:13:28 +01:00
pcm_native.c ALSA: pcm: constify action_ops structures 2015-11-30 11:39:13 +01:00
pcm_timer.c ALSA: pcm: Use standard printk helpers 2014-02-14 08:14:15 +01:00
pcm_trace.h ALSA: pcm: Replace PCM hwptr tracking with tracepoints 2014-11-04 14:09:14 +01:00
rawmidi.c ALSA: core: Drop superfluous error/debug messages after malloc failures 2015-03-10 15:42:14 +01:00
rawmidi_compat.c
rtctimer.c ALSA: timer: Use standard printk helpers 2014-02-14 08:14:17 +01:00
sgbuf.c ALSA: core: Deletion of unnecessary checks before two function calls 2014-11-21 20:06:57 +01:00
sound.c ALSA: replace CONFIG_PROC_FS with CONFIG_SND_PROC_FS 2015-05-27 21:25:19 +02:00
sound_oss.c ALSA: replace CONFIG_PROC_FS with CONFIG_SND_PROC_FS 2015-05-27 21:25:19 +02:00
timer.c ALSA: replace CONFIG_PROC_FS with CONFIG_SND_PROC_FS 2015-05-27 21:25:19 +02:00
timer_compat.c ALSA: Kill snd_assert() in sound/core/* 2008-08-13 11:46:35 +02:00
vmaster.c ALSA: core: Use standard printk helpers 2014-02-14 08:14:15 +01:00