• Takashi Iwai's avatar
    ALSA: seq: Fix race of get-subscription call vs port-delete ioctls · 2eabc5ec
    Takashi Iwai authored
    The snd_seq_ioctl_get_subscription() retrieves the port subscriber
    information as a pointer, while the object isn't protected, hence it
    may be deleted before the actual reference.  This race was spotted by
    syzkaller and may lead to a UAF.
    
    The fix is simply copying the data in the lookup function that
    performs in the rwsem to protect against the deletion.
    
    Reported-by: syzbot+9437020c82413d00222d@syzkaller.appspotmail.com
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    2eabc5ec
seq_ports.c 18.6 KB