diff options
| author | Takashi Iwai <tiwai@suse.de> | 2020-01-15 21:37:33 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-01-23 08:21:28 +0100 |
| commit | 20f2e4c228c712158113583947f4e16691e951f6 (patch) | |
| tree | 8ba99cad9407fd4b86244420b5bfdbaf07a6cca7 /include/linux/nospec.h | |
| parent | e68bc5ef7dcb69fbd3009914129e2c1ddda58a6b (diff) | |
ALSA: seq: Fix racy access for queue timer in proc read
commit 60adcfde92fa40fcb2dbf7cc52f9b096e0cd109a upstream.
snd_seq_info_timer_read() reads the information of the timer assigned
for each queue, but it's done in a racy way which may lead to UAF as
spotted by syzkaller.
This patch applies the missing q->timer_mutex lock while accessing the
timer object as well as a slight code change to adapt the standard
coding style.
Reported-by: syzbot+2b2ef983f973e5c40943@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200115203733.26530-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/linux/nospec.h')
0 files changed, 0 insertions, 0 deletions