diff options
| author | Robb Glasser <rglasser@google.com> | 2017-12-05 09:16:55 -0800 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2017-12-05 23:28:08 +0100 |
| commit | 362bca57f5d78220f8b5907b875961af9436e229 (patch) | |
| tree | 744d83b54aa7820babaa178e52336159b024b161 /fs/file.c | |
| parent | f429e7e494afaded76e62c6f98211a635aa03098 (diff) | |
ALSA: pcm: prevent UAF in snd_pcm_infosound-4.15-rc3
When the device descriptor is closed, the `substream->runtime` pointer
is freed. But another thread may be in the ioctl handler, case
SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
calls snd_pcm_info() which accesses the now freed `substream->runtime`.
Note: this fixes CVE-2017-0861
Signed-off-by: Robb Glasser <rglasser@google.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'fs/file.c')
0 files changed, 0 insertions, 0 deletions