projects / linux-2.6-block.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a2ff19f) | patch
ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
authorTakashi Iwai <tiwai@suse.de>
Sat, 10 Mar 2018 22:04:23 +0000 (23:04 +0100)
committerTakashi Iwai <tiwai@suse.de>
Sun, 11 Mar 2018 09:25:10 +0000 (10:25 +0100)
commit01c0b4265cc16bc1f43f475c5944c55c10d5768f
tree1b6bcb6a25c2c4d73eb9f3247f63c84216f6a9bbtree | snapshot
parenta2ff19f7b70118ced291a28d5313469914de451bcommit | diff
ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()

snd_pcm_oss_get_formats() has an obvious use-after-free around
snd_mask_test() calls, as spotted by syzbot.  The passed format_mask
argument is a pointer to the hw_params object that is freed before the
loop.  What a surprise that it has been present since the original
code of decades ago...

Reported-by: syzbot+4090700a4f13fccaf648@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/oss/pcm_oss.c diff | blob | blame | history
Linux 6.x block layer and io_uring tree(s)