diff options
| author | Takashi Iwai <tiwai@suse.de> | 2017-02-08 12:35:39 +0100 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-07-04 11:51:06 +0200 |
| commit | 1c0202f1d38de27c9619320283a0b75dc732068a (patch) | |
| tree | be2bd5be72f997a8bce7c3c3b6f1a4a52ff24533 /kernel/sysctl.c | |
| parent | 5fc34329199debee36cc1885d67a9b46f868a456 (diff) | |
ALSA: seq: Fix race at creating a queue
commit 4842e98f26dd80be3623c4714a244ba52ea096a8 upstream.
When a sequencer queue is created in snd_seq_queue_alloc(),it adds the
new queue element to the public list before referencing it. Thus the
queue might be deleted before the call of snd_seq_queue_use(), and it
results in the use-after-free error, as spotted by syzkaller.
The fix is to reference the queue object at the right time.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Diffstat (limited to 'kernel/sysctl.c')
0 files changed, 0 insertions, 0 deletions