Takashi Iwai 4842e98f26 ALSA: seq: Fix race at creating a queue ...

When a sequencer queue is created in snd_seq_queue_alloc(),it adds the
new queue element to the public list before referencing it.  Thus the
queue might be deleted before the call of snd_seq_queue_use(), and it
results in the use-after-free error, as spotted by syzkaller.

The fix is to reference the queue object at the right time.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

2017-02-08 12:42:37 +01:00

..

oss

ALSA: oss: don't opencode IS_REACHABLE()

2016-11-12 10:12:00 +01:00

seq

ALSA: seq: Fix race at creating a queue

2017-02-08 12:42:37 +01:00

compress_offload.c

ALSA: compress: fix some missing and misplaced \n in messages

2016-09-16 19:24:13 +02:00

control_compat.c

…

control.c

…

ctljack.c

…

device.c

…

hrtimer.c

ktime: Get rid of the union

2016-12-25 17:21:22 +01:00

hwdep_compat.c

…

hwdep.c

…

info_oss.c

…

info.c

ALSA: info: Return error for invalid read/write

2016-11-08 14:37:26 +01:00

init.c

…

isadma.c

…

jack.c

…

Kconfig

…

Makefile

…

memalloc.c

…

memory.c

…

misc.c

printk/sound: handle more message headers

2016-12-12 18:55:09 -08:00

pcm_compat.c

…

pcm_dmaengine.c

…

pcm_drm_eld.c

…

pcm_iec958.c

…

pcm_lib.c

…

pcm_memory.c

…

pcm_misc.c

…

pcm_native.c

ALSA: pcm: Fix avail to return error if stream is suspended

2016-09-06 12:10:29 +02:00

pcm_timer.c

…

pcm_trace.h

…

pcm.c

…

rawmidi_compat.c

…

rawmidi.c

ALSA: rawmidi: don't opencode IS_REACHABLE()

2016-11-12 10:11:52 +01:00

sgbuf.c

…

sound_oss.c

…

sound.c

…

timer_compat.c

…

timer.c

ALSA: timer: Fix zero-division by continue of uninitialized instance

2016-09-08 10:45:05 +02:00

vmaster.c

…