Commit 712df95d authored by Takashi Iwai's avatar Takashi Iwai Committed by Luis Henriques

ALSA: seq: Fix race at timer setup and close

commit 3567eb6a upstream.

ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client.  This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.

This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Tested-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent f9d70229
...@@ -144,8 +144,10 @@ static struct snd_seq_queue *queue_new(int owner, int locked) ...@@ -144,8 +144,10 @@ static struct snd_seq_queue *queue_new(int owner, int locked)
static void queue_delete(struct snd_seq_queue *q) static void queue_delete(struct snd_seq_queue *q)
{ {
/* stop and release the timer */ /* stop and release the timer */
mutex_lock(&q->timer_mutex);
snd_seq_timer_stop(q->timer); snd_seq_timer_stop(q->timer);
snd_seq_timer_close(q); snd_seq_timer_close(q);
mutex_unlock(&q->timer_mutex);
/* wait until access free */ /* wait until access free */
snd_use_lock_sync(&q->use_lock); snd_use_lock_sync(&q->use_lock);
/* release resources... */ /* release resources... */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment