Commit 362bca57 authored Dec 05, 2017 by Robb Glasser Committed by Takashi Iwai Dec 05, 2017

ALSA: pcm: prevent UAF in snd_pcm_info



When the device descriptor is closed, the `substream->runtime` pointer
is freed. But another thread may be in the ioctl handler, case
SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
calls snd_pcm_info() which accesses the now freed `substream->runtime`.

Note: this fixes CVE-2017-0861

Signed-off-by: Robb Glasser <rglasser@google.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

parent f429e7e4

sound/core/pcm.c

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -153,7 +153,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card,
	err = -ENXIO;		err = -ENXIO;
	goto _error;		goto _error;
	}		}
			mutex_lock(&pcm->open_mutex);
	err = snd_pcm_info_user(substream, info);		err = snd_pcm_info_user(substream, info);
			mutex_unlock(&pcm->open_mutex);
	_error:		_error:
	mutex_unlock(&register_mutex);		mutex_unlock(&register_mutex);
	return err;		return err;

Admin message