mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-01-22 00:21:42 +07:00
d15d662e89
ALSA sequencer core initializes the event pool on demand by invoking snd_seq_pool_init() when the first write happens and the pool is empty. Meanwhile user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound accesses since the function tries to vmalloc / vfree the buffer. A simple fix is to just wrap the snd_seq_pool_init() call with the recently introduced client->ioctl_mutex; as the calls for snd_seq_pool_init() from other side are always protected with this mutex, we can avoid the race. Reported-by: 范龙飞 <long7573@126.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|---|---|---|
| .. | ||
| oss | ||
| Kconfig | ||
| Makefile | ||
| seq_clientmgr.c | ||
| seq_clientmgr.h | ||
| seq_compat.c | ||
| seq_dummy.c | ||
| seq_fifo.c | ||
| seq_fifo.h | ||
| seq_info.c | ||
| seq_info.h | ||
| seq_lock.c | ||
| seq_lock.h | ||
| seq_memory.c | ||
| seq_memory.h | ||
| seq_midi_emul.c | ||
| seq_midi_event.c | ||
| seq_midi.c | ||
| seq_ports.c | ||
| seq_ports.h | ||
| seq_prioq.c | ||
| seq_prioq.h | ||
| seq_queue.c | ||
| seq_queue.h | ||
| seq_system.c | ||
| seq_system.h | ||
| seq_timer.c | ||
| seq_timer.h | ||
| seq_virmidi.c | ||
| seq.c | ||