• T
    ALSA: rawmidi: Avoid racy info ioctl via ctl device · c1cfd902
    Takashi Iwai 提交于
    The rawmidi also allows to obtaining the information via ioctl of ctl
    API.  It means that user can issue an ioctl to the rawmidi device even
    when it's being removed as long as the control device is present.
    Although the code has some protection via the global register_mutex,
    its range is limited to the search of the corresponding rawmidi
    object, and the mutex is already unlocked at accessing the rawmidi
    object.  This may lead to a use-after-free.
    
    For avoiding it, this patch widens the application of register_mutex
    to the whole snd_rawmidi_info_select() function.  We have another
    mutex per rawmidi object, but this operation isn't very hot path, so
    it shouldn't matter from the performance POV.
    
    Cc: <stable@vger.kernel.org>
    Signed-off-by: NTakashi Iwai <tiwai@suse.de>
    c1cfd902
rawmidi.c 49.4 KB