Takashi Iwai 5ee6abaa53 ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() ...

commit 01c0b4265cc16bc1f43f475c5944c55c10d5768f upstream.

snd_pcm_oss_get_formats() has an obvious use-after-free around
snd_mask_test() calls, as spotted by syzbot.  The passed format_mask
argument is a pointer to the hw_params object that is freed before the
loop.  What a surprise that it has been present since the original
code of decades ago...

Reported-by: syzbot+4090700a4f13fccaf648@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-03-21 12:06:42 +01:00

..

oss

ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()

2018-03-21 12:06:42 +01:00

seq

ALSA: seq: More protection for concurrent write and ioctl races

2018-03-15 10:54:34 +01:00

compress_offload.c

ALSA: compress: Remove unused variable

2017-09-18 15:45:01 +02:00

control_compat.c

ALSA: Get rid of card power_lock

2017-08-30 20:44:29 +02:00

control.c

ALSA: control: Fix memory corruption risk in snd_ctl_elem_read

2018-03-08 22:41:02 -08:00

ctljack.c

ALSA: declare snd_kcontrol_new structures as const

2017-05-30 10:29:25 +02:00

device.c

ALSA: core: Use %pS printk format for direct addresses

2017-09-07 10:36:02 +02:00

hrtimer.c

ALSA: timer: Limit max instances per timer

2017-11-06 10:41:24 +01:00

hwdep_compat.c

…

hwdep.c

sched/wait: Rename wait_queue_t => wait_queue_entry_t

2017-06-20 12:18:27 +02:00

info_oss.c

ALSA: core: Follow standard EXPORT_SYMBOL() declarations

2017-06-16 16:19:16 +02:00

info.c

ALSA: core: Follow standard EXPORT_SYMBOL() declarations

2017-06-16 16:19:16 +02:00

init.c

ALSA: Get rid of card power_lock

2017-08-30 20:44:29 +02:00

isadma.c

ALSA: core: Follow standard EXPORT_SYMBOL() declarations

2017-06-16 16:19:16 +02:00

jack.c

ALSA: jack: Allow building the jack layer without input device

2016-02-23 09:03:07 +01:00

Kconfig

ALSA: seq: Allow the modular sequencer registration

2017-06-12 08:43:33 +02:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

memalloc.c

ALSA: core: Follow standard EXPORT_SYMBOL() declarations

2017-06-16 16:19:16 +02:00

memory.c

ALSA: core: Follow standard EXPORT_SYMBOL() declarations

2017-06-16 16:19:16 +02:00

misc.c

ALSA: core: Follow standard EXPORT_SYMBOL() declarations

2017-06-16 16:19:16 +02:00

pcm_compat.c

ALSA: pcm: Fix structure definition for X32 ABI

2017-09-22 11:23:48 +02:00

pcm_dmaengine.c

ASoC: dmaengine_pcm: Add support for packed transfers

2016-04-27 17:34:11 +01:00

pcm_drm_eld.c

ALSA: pcm: use helper function to refer parameter as read-only

2017-05-17 07:24:39 +02:00

pcm_iec958.c

ALSA: pcm: Allow 32 bit sample format in IEC958 channel status helper

2016-04-06 14:33:38 -07:00

pcm_lib.c

ALSA: pcm: Remove yet superfluous WARN_ON()

2018-01-23 19:58:11 +01:00

pcm_local.h

ALSA: pcm: unify codes to operate application-side position on PCM buffer

2017-06-12 08:49:22 +02:00

pcm_memory.c

ALSA: pcm: Follow standard EXPORT_SYMBOL() declarations

2017-06-16 16:18:58 +02:00

pcm_misc.c

ALSA: pcm: Follow standard EXPORT_SYMBOL() declarations

2017-06-16 16:18:58 +02:00

pcm_native.c

ALSA: pcm: Workaround for weird PulseAudio behavior on rewind error

2018-01-17 09:45:19 +01:00

pcm_param_trace.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

pcm_timer.c

ALSA: pcm: include pcm_local.h and remove some extraneous tabs

2017-05-30 18:04:47 +02:00

pcm_trace.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

pcm.c

ALSA: pcm: prevent UAF in snd_pcm_info

2017-12-14 09:52:54 +01:00

rawmidi_compat.c

ALSA: rawmidi: Fix ioctls X32 ABI

2016-02-28 17:44:51 +01:00

rawmidi.c

ALSA: rawmidi: Avoid racy info ioctl via ctl device

2017-12-29 17:53:46 +01:00

seq_device.c

ALSA: seq: Cancel pending autoload work at unbinding device

2017-09-12 12:41:20 +02:00

sgbuf.c

ALSA: core: Deletion of unnecessary checks before two function calls

2014-11-21 20:06:57 +01:00

sound_oss.c

ALSA: core: Follow standard EXPORT_SYMBOL() declarations

2017-06-16 16:19:16 +02:00

sound.c

ALSA: core: Follow standard EXPORT_SYMBOL() declarations

2017-06-16 16:19:16 +02:00

timer_compat.c

ALSA: timer: Remove kernel warning at compat ioctl error paths

2017-11-30 08:40:48 +00:00

timer.c

ALSA: timer: Limit max instances per timer

2017-11-06 10:41:24 +01:00

vmaster.c

ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization

2017-11-30 08:40:49 +00:00