Commit 362bca57 authored by Robb Glasser's avatar Robb Glasser Committed by Takashi Iwai

ALSA: pcm: prevent UAF in snd_pcm_info

When the device descriptor is closed, the `substream->runtime` pointer
is freed. But another thread may be in the ioctl handler, case
SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
calls snd_pcm_info() which accesses the now freed `substream->runtime`.

Note: this fixes CVE-2017-0861
Signed-off-by: default avatarRobb Glasser <rglasser@google.com>
Signed-off-by: default avatarNick Desaulniers <ndesaulniers@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent f429e7e4
...@@ -153,7 +153,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card, ...@@ -153,7 +153,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card,
err = -ENXIO; err = -ENXIO;
goto _error; goto _error;
} }
mutex_lock(&pcm->open_mutex);
err = snd_pcm_info_user(substream, info); err = snd_pcm_info_user(substream, info);
mutex_unlock(&pcm->open_mutex);
_error: _error:
mutex_unlock(&register_mutex); mutex_unlock(&register_mutex);
return err; return err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment