ALSA: pcm: prevent UAF in snd_pcm_info

When the device descriptor is closed, the `substream->runtime` pointer is freed. But another thread may be in the ioctl handler, case SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which calls snd_pcm_info() which accesses the now freed `substream->runtime`. Bug: 36006981 Signed-off-by: Robb Glasser <[email protected]> Signed-off-by: Nick Desaulniers <[email protected]> Change-Id: I445d24bc21dc0af6d9522a8daabe64969042236a Signed-off-by: Francisco Franco <[email protected]>
franciscofranco · May 11, 2018 · 8be6351 · 8be6351
1 parent e105838
commit 8be6351
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
@@ -146,7 +146,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card,
 				err = -ENXIO;
 				goto _error;
 			}
+			mutex_lock(&pcm->open_mutex);
 			err = snd_pcm_info_user(substream, info);
+			mutex_unlock(&pcm->open_mutex);
 		_error:
 			mutex_unlock(&register_mutex);
 			return err;