android_kernel_motorola_sm6375/sound
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Takashi Iwai 4d81a7bdd3 ALSA: seq: oss: Serialize ioctls
commit 80982c7e834e5d4e325b6ce33757012ecafdf0bb upstream.

Some ioctls via OSS sequencer API may race and lead to UAF when the
port create and delete are performed concurrently, as spotted by a
couple of syzkaller cases.  This patch is an attempt to address it by
serializing the ioctls with the existing register_mutex.

Basically OSS sequencer API is an obsoleted interface and was designed
without much consideration of the concurrency.  There are very few
applications with it, and the concurrent performance isn't asked,
hence this "big hammer" approach should be good enough.

Reported-by: syzbot+1a54a94bd32716796edd@syzkaller.appspotmail.com
Reported-by: syzbot+9d2abfef257f3e2d4713@syzkaller.appspotmail.com
Suggested-by: Hillf Danton <hdanton@sina.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200804185815.2453-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-11 15:33:33 +02:00
..
ac97
aoa
arm
atmel
core ALSA: seq: oss: Serialize ioctls 2020-08-11 15:33:33 +02:00
drivers ALSA: opl3: fix infoleak in opl3 2020-07-16 08:16:42 +02:00
firewire ALSA: firewire-lib: fix invalid assignment to union data for directional parameter 2020-06-24 17:50:25 +02:00
hda ALSA: hda: Manage concurrent reg access more properly 2020-05-27 17:46:37 +02:00
i2c
isa ALSA: isa/wavefront: prevent out of bounds write in ioctl 2020-06-24 17:50:11 +02:00
mips
oss
parisc
pci ALSA: hda/ca0132 - Fix AE-5 microphone selection commands. 2020-08-11 15:33:33 +02:00
pcmcia
ppc
sh
soc ASoC: topology: fix tlvs in error handling for widget_dmixer 2020-07-29 10:18:45 +02:00
sparc
spi
synth
usb ALSA: usb-audio: Add implicit feedback quirk for SSL2 2020-08-05 09:59:41 +02:00
x86
xen
ac97_bus.c
Kconfig
last.c
Makefile
sound_core.c