d0f8330652
Although we've covered the races between concurrent write() and
ioctl() in the previous patch series, there is still a possible UAF in
the following scenario:
A: user client closed B: timer irq
-> snd_seq_release() -> snd_seq_timer_interrupt()
-> snd_seq_free_client() -> snd_seq_check_queue()
-> cell = snd_seq_prioq_cell_peek()
-> snd_seq_prioq_leave()
.... removing all cells
-> snd_seq_pool_done()
.... vfree()
-> snd_seq_compare_tick_time(cell)
... Oops
So the problem is that a cell is peeked and accessed without any
protection until it's retrieved from the queue again via
snd_seq_prioq_cell_out().
This patch tries to address it, also cleans up the code by a slight
refactoring. snd_seq_prioq_cell_out() now receives an extra pointer
argument. When it's non-NULL, the function checks the event timestamp
with the given pointer. The caller needs to pass the right reference
either to snd_seq_tick or snd_seq_realtime depending on the event
timestamp type.
A good news is that the above change allows us to remove the
snd_seq_prioq_cell_peek(), too, thus the patch actually reduces the
code size.
Reviewed-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
61 lines
1.9 KiB
C
61 lines
1.9 KiB
C
/*
|
|
* ALSA sequencer Priority Queue
|
|
* Copyright (c) 1998 by Frank van de Pol <fvdpol@coil.demon.nl>
|
|
*
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*
|
|
*/
|
|
#ifndef __SND_SEQ_PRIOQ_H
|
|
#define __SND_SEQ_PRIOQ_H
|
|
|
|
#include "seq_memory.h"
|
|
|
|
|
|
/* === PRIOQ === */
|
|
|
|
struct snd_seq_prioq {
|
|
struct snd_seq_event_cell *head; /* pointer to head of prioq */
|
|
struct snd_seq_event_cell *tail; /* pointer to tail of prioq */
|
|
int cells;
|
|
spinlock_t lock;
|
|
};
|
|
|
|
|
|
/* create new prioq (constructor) */
|
|
struct snd_seq_prioq *snd_seq_prioq_new(void);
|
|
|
|
/* delete prioq (destructor) */
|
|
void snd_seq_prioq_delete(struct snd_seq_prioq **fifo);
|
|
|
|
/* enqueue cell to prioq */
|
|
int snd_seq_prioq_cell_in(struct snd_seq_prioq *f, struct snd_seq_event_cell *cell);
|
|
|
|
/* dequeue cell from prioq */
|
|
struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f,
|
|
void *current_time);
|
|
|
|
/* return number of events available in prioq */
|
|
int snd_seq_prioq_avail(struct snd_seq_prioq *f);
|
|
|
|
/* client left queue */
|
|
void snd_seq_prioq_leave(struct snd_seq_prioq *f, int client, int timestamp);
|
|
|
|
/* Remove events */
|
|
void snd_seq_prioq_remove_events(struct snd_seq_prioq *f, int client,
|
|
struct snd_seq_remove_events *info);
|
|
|
|
#endif
|