android_kernel_google_msm/sound
Takashi Iwai 6e47c42f2a ALSA: seq: Fix race at timer setup and close
ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client.  This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.

This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.

Change-Id: I58773978b545fb73311e2eab973ab63c9099dba1
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-06-26 18:21:28 +03:00
..
aoa
arm ARM: cleanups of io includes 2012-03-29 18:02:10 -07:00
atmel
compress_offload Fixes for 1. fixes for comments recieved on alsa-devel 2013-02-25 11:41:23 -08:00
core ALSA: seq: Fix race at timer setup and close 2017-06-26 18:21:28 +03:00
drivers Documentation: remove references to /etc/modprobe.conf 2012-03-30 16:03:15 -07:00
firewire IEEE 1394 (FireWire) subsystem updates post v3.3: 2012-03-22 20:31:15 -07:00
i2c [media] tea575x: fix HW seek 2012-03-19 11:28:52 -03:00
isa ALSA: sound/isa/sscape.c: add missing resource-release code 2012-04-10 08:42:07 +02:00
mips
oss sound: sound/oss/msnd_pinnacle.c: add vfrees 2012-04-10 08:41:54 +02:00
parisc
pci sound fixes for 3.4 2012-05-16 14:29:45 -07:00
pcmcia
ppc
sh
soc ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver 2017-06-26 17:04:55 +03:00
sparc
spi
synth
usb ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call 2016-11-11 13:37:28 +11:00
ac97_bus.c
Kconfig
last.c ALSA: workaround: change the timing of alsa_sound_last_init() 2012-04-19 13:51:54 +02:00
Makefile
sound_core.c
sound_firmware.c