Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e11ae21c authored by Robb Glasser's avatar Robb Glasser Committed by Dyneteve
Browse files

ALSA: pcm: prevent UAF in snd_pcm_info 



When the device descriptor is closed, the `substream->runtime` pointer
is freed. But another thread may be in the ioctl handler, case
SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
calls snd_pcm_info() which accesses the now freed `substream->runtime`.

Bug: 36006981
Signed-off-by: default avatarRobb Glasser <rglasser@google.com>
Signed-off-by: default avatarNick Desaulniers <ndesaulniers@google.com>
Change-Id: I445d24bc21dc0af6d9522a8daabe64969042236a
parent 92154c28

sound/core/pcm.c

+2 −0
Original line number Diff line number Diff line
@@ -150,7 +150,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card, 
				err = -ENXIO;

				goto _error;

			}

			mutex_lock(&pcm->open_mutex);

			err = snd_pcm_info_user(substream, info);

			mutex_unlock(&pcm->open_mutex);

		_error:

			mutex_unlock(&register_mutex);

			return err;