kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
No description
711,091 commits 117 branches 5,827 tags 6.3 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Takashi Iwai 0609022631 ALSA: seq: Fix possible UAF in snd_seq_check_queue() 
commit d0f8330652 upstream.

Although we've covered the races between concurrent write() and
ioctl() in the previous patch series, there is still a possible UAF in
the following scenario:

A: user client closed		B: timer irq
  -> snd_seq_release()		  -> snd_seq_timer_interrupt()
    -> snd_seq_free_client()	    -> snd_seq_check_queue()
				      -> cell = snd_seq_prioq_cell_peek()
      -> snd_seq_prioq_leave()
         .... removing all cells
      -> snd_seq_pool_done()
         .... vfree()
				      -> snd_seq_compare_tick_time(cell)
				         ... Oops

So the problem is that a cell is peeked and accessed without any
protection until it's retrieved from the queue again via
snd_seq_prioq_cell_out().

This patch tries to address it, also cleans up the code by a slight
refactoring.  snd_seq_prioq_cell_out() now receives an extra pointer
argument.  When it's non-NULL, the function checks the event timestamp
with the given pointer.  The caller needs to pass the right reference
either to snd_seq_tick or snd_seq_realtime depending on the event
timestamp type.

A good news is that the above change allows us to remove the
snd_seq_prioq_cell_peek(), too, thus the patch actually reduces the
code size.

Reviewed-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2018-03-21 12:06:42 +01:00
arch parisc: Handle case where flush_cache_range is called with no context 2018-03-21 12:06:42 +01:00
block blk-mq: don't call io sched's .requeue_request when requeueing rq to ->dispatch 2018-03-08 22:41:20 -08:00
certs License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
crypto crypto: ecc - Fix NULL pointer deref. on no default_rng 2018-03-19 08:42:49 +01:00
Documentation usb: host: xhci-rcar: add support for r8a77965 2018-03-19 08:42:45 +01:00
drivers drm/i915/glk: Disable Guc and HuC on GLK 2018-03-19 08:42:57 +01:00
firmware License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fs userns: Don't fail follow_automount based on s_user_ns 2018-03-19 08:42:50 +01:00
include dma-buf/fence: Fix lock inversion within dma-fence-array 2018-03-19 08:42:47 +01:00
init kmemcheck: stop using GFP_NOTRACK and SLAB_NOTRACK 2018-02-22 15:42:23 +01:00
ipc License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
kernel locking/locktorture: Fix num reader/writer corner cases 2018-03-19 08:42:56 +01:00
lib Fix misannotated out-of-line _copy_to_user() 2018-03-19 08:42:56 +01:00
mm mm/memblock.c: hardcode the end_pfn being -1 2018-03-15 10:54:32 +01:00
net mac80211: remove BUG() when interface type is invalid 2018-03-19 08:42:55 +01:00
samples samples/bpf: adjust rlimit RLIMIT_MEMLOCK for xdp1 2017-12-20 10:10:31 +01:00
scripts objtool, retpolines: Integrate objtool with retpoline support more closely 2018-03-15 10:54:38 +01:00
security ima: relax requiring a file signature for new files with zero length 2018-03-19 08:42:56 +01:00
sound ALSA: seq: Fix possible UAF in snd_seq_check_queue() 2018-03-21 12:06:42 +01:00
tools selftests/x86/entry_from_vm86: Add test cases for POPF 2018-03-21 12:06:41 +01:00
usr initramfs: fix initramfs rebuilds w/ compression after disabling 2017-11-03 07:39:19 -07:00
virt KVM: mmu: Fix overlap between public and private memslots 2018-03-08 22:41:24 -08:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Add hch to .get_maintainer.ignore 2015-08-21 14:30:10 -07:00
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore kbuild: rpm-pkg: keep spec file until make mrproper 2018-02-13 10:19:46 +01:00
.mailmap .mailmap: Add Maciej W. Rozycki's Imagination e-mail address 2017-11-10 12:16:15 -08:00
COPYING [PATCH] update FSF address in COPYING 2005-09-10 10:06:29 -07:00
CREDITS MAINTAINERS: update TPM driver infrastructure changes 2017-11-09 17:58:40 -08:00
Kbuild License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
MAINTAINERS dt-bindings: Document mti,mips-cpc binding 2018-03-15 10:54:35 +01:00
Makefile Linux 4.14.28 2018-03-19 08:42:57 +01:00
README README: add a new README file, pointing to the Documentation/ 2016-10-24 08:12:35 -02:00

README 

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.