80982c7e83
Some ioctls via OSS sequencer API may race and lead to UAF when the port create and delete are performed concurrently, as spotted by a couple of syzkaller cases. This patch is an attempt to address it by serializing the ioctls with the existing register_mutex. Basically OSS sequencer API is an obsoleted interface and was designed without much consideration of the concurrency. There are very few applications with it, and the concurrent performance isn't asked, hence this "big hammer" approach should be good enough. Reported-by: syzbot+1a54a94bd32716796edd@syzkaller.appspotmail.com Reported-by: syzbot+9d2abfef257f3e2d4713@syzkaller.appspotmail.com Suggested-by: Hillf Danton <hdanton@sina.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200804185815.2453-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|---|---|---|
| .. | ||
| Makefile | ||
| seq_oss.c | ||
| seq_oss_device.h | ||
| seq_oss_event.c | ||
| seq_oss_event.h | ||
| seq_oss_init.c | ||
| seq_oss_ioctl.c | ||
| seq_oss_midi.c | ||
| seq_oss_midi.h | ||
| seq_oss_readq.c | ||
| seq_oss_readq.h | ||
| seq_oss_rw.c | ||
| seq_oss_synth.c | ||
| seq_oss_synth.h | ||
| seq_oss_timer.c | ||
| seq_oss_timer.h | ||
| seq_oss_writeq.c | ||
| seq_oss_writeq.h | ||