Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 362bca57 authored by Robb Glasser's avatar Robb Glasser Committed by Takashi Iwai
Browse files

ALSA: pcm: prevent UAF in snd_pcm_info 



When the device descriptor is closed, the `substream->runtime` pointer
is freed. But another thread may be in the ioctl handler, case
SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
calls snd_pcm_info() which accesses the now freed `substream->runtime`.

Note: this fixes CVE-2017-0861

Signed-off-by: default avatarRobb Glasser <rglasser@google.com>
Signed-off-by: default avatarNick Desaulniers <ndesaulniers@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent f429e7e4

sound/core/pcm.c

+2 −0
Original line number Diff line number Diff line
@@ -153,7 +153,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card, 
				err = -ENXIO;

				goto _error;

			}

			mutex_lock(&pcm->open_mutex);

			err = snd_pcm_info_user(substream, info);

			mutex_unlock(&pcm->open_mutex);

		_error:

			mutex_unlock(&register_mutex);

			return err;