From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:59492 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932120AbdERMWX (ORCPT ); Thu, 18 May 2017 08:22:23 -0400 Subject: Patch "ALSA: seq: Fix race at timer setup and close" has been added to the 3.18-stable tree To: tiwai@suse.de, amit.pundir@linaro.org, dvyukov@google.com, gregkh@linuxfoundation.org Cc: , From: Date: Thu, 18 May 2017 14:22:10 +0200 Message-ID: <1495110130131195@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ALSA: seq: Fix race at timer setup and close to the 3.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: alsa-seq-fix-race-at-timer-setup-and-close.patch and it can be found in the queue-3.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 3567eb6af614dac436c4b16a8d426f9faed639b3 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Tue, 12 Jan 2016 15:36:27 +0100 Subject: ALSA: seq: Fix race at timer setup and close From: Takashi Iwai commit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream. ALSA sequencer code has an open race between the timer setup ioctl and the close of the client. This was triggered by syzkaller fuzzer, and a use-after-free was caught there as a result. This patch papers over it by adding a proper queue->timer_mutex lock around the timer-related calls in the relevant code path. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Signed-off-by: Takashi Iwai Signed-off-by: Amit Pundir Signed-off-by: Greg Kroah-Hartman --- sound/core/seq/seq_queue.c | 2 ++ 1 file changed, 2 insertions(+) --- a/sound/core/seq/seq_queue.c +++ b/sound/core/seq/seq_queue.c @@ -142,8 +142,10 @@ static struct snd_seq_queue *queue_new(i static void queue_delete(struct snd_seq_queue *q) { /* stop and release the timer */ + mutex_lock(&q->timer_mutex); snd_seq_timer_stop(q->timer); snd_seq_timer_close(q); + mutex_unlock(&q->timer_mutex); /* wait until access free */ snd_use_lock_sync(&q->use_lock); /* release resources... */ Patches currently in stable-queue which might be from tiwai@suse.de are queue-3.18/alsa-timer-fix-leak-in-events-via-snd_timer_user_ccallback.patch queue-3.18/alsa-timer-fix-leak-in-sndrv_timer_ioctl_params.patch queue-3.18/alsa-timer-fix-race-among-timer-ioctls.patch queue-3.18/alsa-timer-fix-leak-in-events-via-snd_timer_user_tinterrupt.patch queue-3.18/alsa-seq-fix-race-at-timer-setup-and-close.patch