• Takashi Iwai's avatar
    ALSA: seq: Fix race during FIFO resize · 2d7d5400
    Takashi Iwai authored
    When a new event is queued while processing to resize the FIFO in
    snd_seq_fifo_clear(), it may lead to a use-after-free, as the old pool
    that is being queued gets removed.  For avoiding this race, we need to
    close the pool to be deleted and sync its usage before actually
    deleting it.
    
    The issue was spotted by syzkaller.
    Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    2d7d5400
seq_fifo.c 6.12 KB