forked from luck/tmp_suning_uos_patched
2d1b5c0836
The virmidi driver has an open race at closing its assigned rawmidi device, and this may lead to use-after-free in snd_seq_deliver_single_event(). Plug the hole by properly protecting the linked list deletion and calling in the right order in snd_virmidi_input_close(). BugLink: http://lkml.kernel.org/r/CACT4Y+Zd66+w12fNN85-425cVQT=K23kWbhnCEcMB8s3us-Frw@mail.gmail.com Reported-by: Dmitry Vyukov <dvyukov@google.com> Tested-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
---|---|---|
.. | ||
oss | ||
seq | ||
compress_offload.c | ||
control_compat.c | ||
control.c | ||
ctljack.c | ||
device.c | ||
hrtimer.c | ||
hwdep_compat.c | ||
hwdep.c | ||
info_oss.c | ||
info.c | ||
init.c | ||
isadma.c | ||
jack.c | ||
Kconfig | ||
Makefile | ||
memalloc.c | ||
memory.c | ||
misc.c | ||
pcm_compat.c | ||
pcm_dmaengine.c | ||
pcm_drm_eld.c | ||
pcm_iec958.c | ||
pcm_lib.c | ||
pcm_memory.c | ||
pcm_misc.c | ||
pcm_native.c | ||
pcm_timer.c | ||
pcm_trace.h | ||
pcm.c | ||
rawmidi_compat.c | ||
rawmidi.c | ||
rtctimer.c | ||
sgbuf.c | ||
sound_oss.c | ||
sound.c | ||
timer_compat.c | ||
timer.c | ||
vmaster.c |