iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/sound/core
History
Takashi Iwai 411cef6adf ALSA: mixer: oss: Fix racy access to slots 
The OSS mixer can reassign the mapping slots dynamically via proc
file.  Although the addition and deletion of those slots are protected
by mixer->reg_mutex, the access to slots aren't, hence this may cause
UAF when the slots in use are deleted concurrently.

This patch applies the mixer->reg_mutex in all appropriate code paths
(i.e. the ioctl functions) that may access slots.

Reported-by: syzbot+9988f17cf72a1045a189@syzkaller.appspotmail.com
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/00000000000036adc005ceca9175@google.com
Link: https://lore.kernel.org/r/20211020164846.922-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-10-21 07:03:47 +02:00
..
oss
ALSA: mixer: oss: Fix racy access to slots
2021-10-21 07:03:47 +02:00
seq
Merge branch 'for-linus' into for-next
2021-08-09 07:53:22 +02:00
compress_offload.c
ALSA: compress: Initialize mutex in snd_compress_new()
2021-07-15 10:22:38 +02:00
control_compat.c
ALSA: control: Drop superfluous snd_power_wait() calls
2021-05-25 08:48:49 +02:00
control_led.c
ALSA: core: control_led: use strscpy instead of strlcpy
2021-08-13 08:05:17 +02:00
control.c
ALSA: control: Minor optimization for SNDRV_CTL_IOCTL_POWER_STATE
2021-05-25 08:49:06 +02:00
ctljack.c
ALSA: Convert strlcpy to strscpy when return value is unused
2021-01-08 09:30:05 +01:00
device.c
ALSA: core: Add snd_device_get_state() helper
2020-03-23 18:09:19 +01:00
hrtimer.c
ALSA: timer: Replace tasklet with work
2020-09-09 18:32:52 +02:00
hwdep_compat.c
ALSA: compat_ioctl: avoid compat_alloc_user_space
2020-09-21 10:37:07 +02:00
hwdep.c
ALSA: core: Fix assignment in if condition
2021-06-09 17:30:22 +02:00
info_oss.c
ALSA: core: Fix assignment in if condition
2021-06-09 17:30:22 +02:00
info.c
isystem: trim/fixup stdarg.h and other headers
2021-08-19 09:02:55 +09:00
init.c
ALSA: core: Fix double calls of snd_card_free() via devres
2021-07-31 10:36:06 +02:00
isadma.c
ALSA: core: Add device-managed request_dma()
2021-07-19 16:16:34 +02:00
jack.c
ALSA: jack: implement software jack injection via debugfs
2021-02-02 10:37:07 +01:00
Kconfig
ALSA: control - add generic LED trigger module as the new control layer
2021-03-30 15:33:58 +02:00
Makefile
ALSA: control - add generic LED trigger module as the new control layer
2021-03-30 15:33:58 +02:00
memalloc_local.h
ALSA: memalloc: Minor refactoring
2021-08-04 08:07:46 +02:00
memalloc.c
ALSA: memalloc: Count continuous pages in vmalloc buffer handler
2021-08-13 10:17:25 +02:00
memory.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
misc.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
pcm_compat.c
ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl
2021-10-11 18:10:47 +02:00
pcm_dmaengine.c
ASoC: dmaengine_pcm: add peripheral configuration
2021-02-05 17:16:41 +00:00
pcm_drm_eld.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
pcm_iec958.c
ALSA: iec958: Split status creation and fill
2021-06-08 17:05:41 +02:00
pcm_lib.c
ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
2021-08-27 22:34:12 +02:00
pcm_local.h
ALSA: core: Abstract memory alloc helpers
2021-06-10 10:15:21 +02:00
pcm_memory.c
ALSA: pcm: Allow exact buffer preallocation
2021-08-04 08:08:06 +02:00
pcm_misc.c
ALSA: pcm: Fix assignment in if condition
2021-06-09 17:30:24 +02:00
pcm_native.c
ALSA: pcm: Add SNDRV_PCM_INFO_EXPLICIT_SYNC flag
2021-08-14 08:38:25 +02:00
pcm_param_trace.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
pcm_timer.c
ALSA: timer: Constify snd_timer_hardware definitions
2020-01-03 09:24:07 +01:00
pcm_trace.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
pcm.c
ALSA: pcm: use DEVICE_ATTR_RO macro
2021-05-25 09:00:04 +02:00
rawmidi_compat.c
ALSA: rawmidi: Add framing mode
2021-05-17 16:02:44 +02:00
rawmidi.c
ALSA: rawmidi: introduce SNDRV_RAWMIDI_IOCTL_USER_PVERSION
2021-09-23 09:26:40 +02:00
seq_device.c
ALSA: seq: Fix a potential UAF by wrong private_free call order
2021-09-30 14:13:22 +02:00
sgbuf.c
ALSA: memalloc: Fix mmap of SG-buffer with WC pages
2021-08-08 10:01:33 +02:00
sound_oss.c
ALSA: core: Fix assignment in if condition
2021-06-09 17:30:22 +02:00
sound.c
ALSA: core: Fix assignment in if condition
2021-06-09 17:30:22 +02:00
timer_compat.c
ALSA: Convert strlcpy to strscpy when return value is unused
2021-01-08 09:30:05 +01:00
timer.c
ALSA: timer: Fix master timer notification
2021-06-03 09:39:58 +02:00
vmaster.c
ALSA: Replace the word "slave" in vmaster API
2020-07-20 10:10:47 +02:00