diff options
| author | Takashi Iwai <tiwai@suse.de> | 2022-05-13 12:38:28 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-05-15 20:40:27 +0300 |
| commit | a42aa926843acca96c0dfbde2e835b8137f2f092 (patch) | |
| tree | 55559ff8bda13e286fd9b8a3a67653896fe38d13 /include/sound/pcm.h | |
| parent | e4901b989908d69f2268ddcef9acd35b725e413e (diff) | |
| download | linux-a42aa926843acca96c0dfbde2e835b8137f2f092.tar.xz | |
ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
commit 92ee3c60ec9fe64404dc035e7c41277d74aa26cb upstream.
Currently we have neither proper check nor protection against the
concurrent calls of PCM hw_params and hw_free ioctls, which may result
in a UAF. Since the existing PCM stream lock can't be used for
protecting the whole ioctl operations, we need a new mutex to protect
those racy calls.
This patch introduced a new mutex, runtime->buffer_mutex, and applies
it to both hw_params and hw_free ioctl code paths. Along with it, the
both functions are slightly modified (the mmap_count check is moved
into the state-check block) for code simplicity.
Reported-by: Hu Jiahui <kirin.say@gmail.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20220322170720.3529-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[OP: backport to 4.14: adjusted context]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/sound/pcm.h')
| -rw-r--r-- | include/sound/pcm.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/sound/pcm.h b/include/sound/pcm.h index 24febf9e177c..aff851485b4a 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -396,6 +396,7 @@ struct snd_pcm_runtime { wait_queue_head_t sleep; /* poll sleep */ wait_queue_head_t tsleep; /* transfer sleep */ struct fasync_struct *fasync; + struct mutex buffer_mutex; /* protect for buffer changes */ /* -- private section -- */ void *private_data; |