ALSA: seq: Fix race during FIFO resize
authorTakashi Iwai <tiwai@suse.de>
Fri, 24 Mar 2017 16:07:57 +0000 (17:07 +0100)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 18 Jul 2017 17:38:37 +0000 (18:38 +0100)
commitdf7a2d0af9f7ab73cf22a7b62bbc0bad93a02110
tree8f0b194d06d012be502e8eea3ce934354403ba72
parent274b827b507f40a73437e8a10bc7217ddd49861d
ALSA: seq: Fix race during FIFO resize

commit 2d7d54002e396c180db0c800c1046f0a3c471597 upstream.

When a new event is queued while processing to resize the FIFO in
snd_seq_fifo_clear(), it may lead to a use-after-free, as the old pool
that is being queued gets removed.  For avoiding this race, we need to
close the pool to be deleted and sync its usage before actually
deleting it.

The issue was spotted by syzkaller.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
sound/core/seq/seq_fifo.c