diff options
| author | Robb Glasser <[email protected]> | 2017-12-05 09:16:55 -0800 |
|---|---|---|
| committer | Takashi Iwai <[email protected]> | 2017-12-05 23:28:08 +0100 |
| commit | 362bca57f5d78220f8b5907b875961af9436e229 (patch) | |
| tree | 744d83b54aa7820babaa178e52336159b024b161 /include/linux/fpga/fpga-bridge.h | |
| parent | f429e7e494afaded76e62c6f98211a635aa03098 (diff) | |
ALSA: pcm: prevent UAF in snd_pcm_info
When the device descriptor is closed, the `substream->runtime` pointer
is freed. But another thread may be in the ioctl handler, case
SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
calls snd_pcm_info() which accesses the now freed `substream->runtime`.
Note: this fixes CVE-2017-0861
Signed-off-by: Robb Glasser <[email protected]>
Signed-off-by: Nick Desaulniers <[email protected]>
Cc: <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
Diffstat (limited to 'include/linux/fpga/fpga-bridge.h')
0 files changed, 0 insertions, 0 deletions