• T
    ALSA: seq: Fix race during FIFO resize · 2d7d5400
    Takashi Iwai 提交于
    When a new event is queued while processing to resize the FIFO in
    snd_seq_fifo_clear(), it may lead to a use-after-free, as the old pool
    that is being queued gets removed.  For avoiding this race, we need to
    close the pool to be deleted and sync its usage before actually
    deleting it.
    
    The issue was spotted by syzkaller.
    Reported-by: NDmitry Vyukov <dvyukov@google.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: NTakashi Iwai <tiwai@suse.de>
    2d7d5400
seq_fifo.c 6.1 KB