]> git.baikalelectronics.ru Git - kernel.git/commit
ALSA: timer: Add missing mutex lock for compat ioctls
authorTakashi Iwai <tiwai@suse.de>
Sun, 29 Oct 2017 10:02:04 +0000 (11:02 +0100)
committerTakashi Iwai <tiwai@suse.de>
Tue, 31 Oct 2017 07:28:16 +0000 (08:28 +0100)
commit05249d678f3f69cfe10c486e10456c86f867cf0f
tree18d39bf1e0f6241a4ec148415b423e1f3f940251
parentb0aff177c894841686719d03f6c47c74fd954ff4
ALSA: timer: Add missing mutex lock for compat ioctls

The races among ioctl and other operations were protected by the
commit 69e9845cf10b ("ALSA: timer: Fix race among timer ioctls") and
later fixes, but one code path was forgotten in the scenario: the
32bit compat ioctl.  As syzkaller recently spotted, a very similar
use-after-free may happen with the combination of compat ioctls.

The fix is simply to apply the same ioctl_lock to the compat_ioctl
callback, too.

Fixes: 69e9845cf10b ("ALSA: timer: Fix race among timer ioctls")
Reference: http://lkml.kernel.org/r/089e082686ac9b482e055c832617@google.com
Reported-by: syzbot <bot+e5f3c9783e7048a74233054febbe9f1bdf54b6da@syzkaller.appspotmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/timer_compat.c