linux/sound/drivers
Takashi Iwai f2cc987024 ALSA: aloop: Add missing cable lock to ctl API callbacks
commit 76b3421b39 upstream.

Some control API callbacks in aloop driver are too lazy to take the
loopback->cable_lock and it results in possible races of cable access
while it's being freed.  It eventually lead to a UAF, as reported by
fuzzer recently.

This patch covers such control API callbacks and add the proper mutex
locks.

Reported-by: DaeRyong Jeong <threeearcat@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-10-21 08:45:49 +01:00
..
mpu401 ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
opl3 ALSA: opl3: Hardening for potential Spectre v1 2018-10-21 08:45:43 +01:00
opl4 ALSA: opl4: use list_move_tail instead of list_del/list_add_tail 2012-09-05 09:14:45 +02:00
pcsp ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
vx ALSA: vx_core: off by one in vx_read_status() 2013-06-21 14:32:06 +02:00
aloop.c ALSA: aloop: Add missing cable lock to ctl API callbacks 2018-10-21 08:45:49 +01:00
dummy.c ALSA: dummy: Fix a use-after-free at closing 2016-08-22 22:38:20 +01:00
Kconfig ALSA: sound kconfig typo 2013-04-24 14:02:36 +02:00
Makefile ALSA: introduce the snd-aloop module for the PCM loopback 2010-08-09 14:21:11 +02:00
ml403-ac97cr.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
mtpav.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
mts64.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
pcm-indirect2.c Fix common misspellings 2011-03-31 11:26:23 -03:00
pcm-indirect2.h [ALSA] Xilinx ML403 AC97 Controller Reference device driver 2008-01-31 17:29:15 +01:00
portman2x4.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
serial-u16550.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
virmidi.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00