ALSA: seq: Fix race of get-subscription call vs port-delete ioctls

The snd_seq_ioctl_get_subscription() retrieves the port subscriber
information as a pointer, while the object isn't protected, hence it
may be deleted before the actual reference.  This race was spotted by
syzkaller and may lead to a UAF.

The fix is simply copying the data in the lookup function that
performs in the rwsem to protect against the deletion.

Reported-by: [email protected]
Signed-off-by: Takashi Iwai <[email protected]>

0 files changed, 0 insertions, 0 deletions