android_kernel_google_msm/sound
Takashi Iwai 383328af7a ALSA: timer: Fix race between read and ioctl
The read from ALSA timer device, the function snd_timer_user_tread(),
may access to an uninitialized struct snd_timer_user fields when the
read is concurrently performed while the ioctl like
snd_timer_user_tselect() is invoked.  We have already fixed the races
among ioctls via a mutex, but we seem to have forgotten the race
between read vs ioctl.

This patch simply applies (more exactly extends the already applied
range of) tu->ioctl_lock in snd_timer_user_tread() for closing the
race window.

Change-Id: I3b539d6e01d86d5b9cbe813e2616894e6202225f
Reported-by: Alexander Potapenko <glider@google.com>
Tested-by: Alexander Potapenko <glider@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-07-17 05:11:28 +00:00
..
aoa
arm
atmel
compress_offload
core ALSA: timer: Fix race between read and ioctl 2017-07-17 05:11:28 +00:00
drivers
firewire
i2c
isa
mips
oss
parisc
pci
pcmcia
ppc
sh
soc ASoC: msm: qdsp6v2: set pointer to NULL after free. 2017-06-26 20:42:03 +03:00
sparc
spi
synth
usb ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call 2016-11-11 13:37:28 +11:00
ac97_bus.c
Kconfig
last.c
Makefile
sound_core.c
sound_firmware.c