From a7af0f1f7823ddabff5f92ad8526cbb3cbcc015e Mon Sep 17 00:00:00 2001 From: Robb Glasser Date: Fri, 11 Aug 2017 11:33:31 -0700 Subject: ALSA: pcm: prevent UAF in snd_pcm_info When the device descriptor is closed, the `substream->runtime` pointer is freed. But another thread may be in the ioctl handler, case SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which calls snd_pcm_info() which accesses the now freed `substream->runtime`. Bug: 36006981 Signed-off-by: Robb Glasser Signed-off-by: Nick Desaulniers Change-Id: I445d24bc21dc0af6d9522a8daabe64969042236a --- sound/core/pcm.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'sound/core/pcm.c') diff --git a/sound/core/pcm.c b/sound/core/pcm.c index e1e9e0c99..5e95bc66f 100644 --- a/sound/core/pcm.c +++ b/sound/core/pcm.c @@ -150,7 +150,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card, err = -ENXIO; goto _error; } + mutex_lock(&pcm->open_mutex); err = snd_pcm_info_user(substream, info); + mutex_unlock(&pcm->open_mutex); _error: mutex_unlock(®ister_mutex); return err; -- cgit v1.2.3