summaryrefslogtreecommitdiff
path: root/crypto/lz4.c
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2018-02-12 15:20:51 +0100
committerTakashi Iwai <tiwai@suse.de>2018-02-14 10:39:08 +0100
commitd15d662e89fc667b90cd294b0eb45694e33144da (patch)
tree301264d814fae494155ae518c42f380666623ef6 /crypto/lz4.c
parent1dcb1859dd6752131b85c78fb3e440bd1d2cf361 (diff)
ALSA: seq: Fix racy pool initializations
ALSA sequencer core initializes the event pool on demand by invoking snd_seq_pool_init() when the first write happens and the pool is empty. Meanwhile user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound accesses since the function tries to vmalloc / vfree the buffer. A simple fix is to just wrap the snd_seq_pool_init() call with the recently introduced client->ioctl_mutex; as the calls for snd_seq_pool_init() from other side are always protected with this mutex, we can avoid the race. Reported-by: 范龙飞 <long7573@126.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'crypto/lz4.c')
0 files changed, 0 insertions, 0 deletions