No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Takashi Iwai 3fa58fc9f8 ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
commit c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d upstream.

The rawmidi core allows user to resize the runtime buffer via ioctl,
and this may lead to UAF when performed during concurrent reads or
writes: the read/write functions unlock the runtime lock temporarily
during copying form/to user-space, and that's the race window.

This patch fixes the hole by introducing a reference counter for the
runtime buffer read/write access and returns -EBUSY error when the
resize is performed concurrently against read/write.

Note that the ref count field is a simple integer instead of
refcount_t here, since the all contexts accessing the buffer is
basically protected with a spinlock, hence we need no expensive atomic
ops.  Also, note that this busy check is needed only against read /
write functions, and not in receive/transmit callbacks; the race can
happen only at the spinlock hole mentioned in the above, while the
whole function is protected for receive / transmit callbacks.

Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/CAFcO6XMWpUVK_yzzCpp8_XP7+=oUpQvuBeCbMffEDkpe8jWrfg@mail.gmail.com
Link: https://lore.kernel.org/r/s5heerw3r5z.wl-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-20 08:20:30 +02:00
arch arm64: fix the flush_icache_range arguments in machine_kexec 2020-05-20 08:20:24 +02:00
block iocost: protect iocg->abs_vdebt with iocg->waitq.lock 2020-05-14 07:58:27 +02:00
certs
crypto gcc-10: avoid shadowing standard library 'free()' in crypto 2020-05-20 08:20:29 +02:00
Documentation USB: hub: Revert commit bd0e6c9614 ("usb: hub: try old enumeration scheme first for high speed devices") 2020-04-29 16:33:14 +02:00
drivers USB: usbfs: fix mmap dma mismatch 2020-05-20 08:20:30 +02:00
fs NFSv3: fix rpc receive buffer size for MOUNT call 2020-05-20 08:20:27 +02:00
include ALSA: rawmidi: Fix racy buffer resize under concurrent accesses 2020-05-20 08:20:30 +02:00
init gcc-10: mark more functions __init to avoid section mismatch warnings 2020-05-20 08:20:29 +02:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2020-05-20 08:20:16 +02:00
kernel Stop the ad-hoc games with -Wno-maybe-initialized 2020-05-20 08:20:28 +02:00
lib lib: devres: add a helper function for ioremap_uc 2020-05-10 10:31:30 +02:00
LICENSES
mm shmem: fix possible deadlocks on shmlock_user_lock 2020-05-20 08:20:03 +02:00
net net/rds: Use ERR_PTR for rds_message_alloc_sgs() 2020-05-20 08:20:27 +02:00
samples vmalloc: fix remap_vmalloc_range() bounds checks 2020-04-29 16:33:14 +02:00
scripts scripts/decodecode: fix trapping instruction formatting 2020-05-14 07:58:29 +02:00
security selinux: properly handle multiple messages in selinux_netlink_send() 2020-05-06 08:15:17 +02:00
sound ALSA: rawmidi: Fix racy buffer resize under concurrent accesses 2020-05-20 08:20:30 +02:00
tools selftests/ftrace: Check the first record for kprobe_args_type.tc 2020-05-20 08:20:14 +02:00
usr
virt KVM: arm: vgic: Synchronize the whole guest on GIC{D,R}_I{S,C}ACTIVER read 2020-05-20 08:20:04 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile gcc-10: disable 'restrict' warning for now 2020-05-20 08:20:29 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.