diff options
| author | Takashi Iwai <tiwai@suse.de> | 2019-04-09 18:04:17 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2019-04-09 18:54:13 +0200 |
| commit | 2eabc5ec8ab4d4748a82050dfcb994119b983750 (patch) | |
| tree | 13103ccf8a6c0f07e9200403fcd26a30b30200c6 /sound/core/seq/seq_clientmgr.c | |
| parent | feb689025fbb6f0aa6297d3ddf97de945ea4ad32 (diff) | |
ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
The snd_seq_ioctl_get_subscription() retrieves the port subscriber
information as a pointer, while the object isn't protected, hence it
may be deleted before the actual reference. This race was spotted by
syzkaller and may lead to a UAF.
The fix is simply copying the data in the lookup function that
performs in the rwsem to protect against the deletion.
Reported-by: syzbot+9437020c82413d00222d@syzkaller.appspotmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core/seq/seq_clientmgr.c')
| -rw-r--r-- | sound/core/seq/seq_clientmgr.c | 10 |
1 files changed, 2 insertions, 8 deletions
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 976404691261..f256704dc401 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -1897,20 +1897,14 @@ static int snd_seq_ioctl_get_subscription(struct snd_seq_client *client, int result; struct snd_seq_client *sender = NULL; struct snd_seq_client_port *sport = NULL; - struct snd_seq_subscribers *p; result = -EINVAL; if ((sender = snd_seq_client_use_ptr(subs->sender.client)) == NULL) goto __end; if ((sport = snd_seq_port_use_ptr(sender, subs->sender.port)) == NULL) goto __end; - p = snd_seq_port_get_subscription(&sport->c_src, &subs->dest); - if (p) { - result = 0; - *subs = p->info; - } else - result = -ENOENT; - + result = snd_seq_port_get_subscription(&sport->c_src, &subs->dest, + subs); __end: if (sport) snd_seq_port_unlock(sport); |