Takashi Iwai 01c0b4265c ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() ...

snd_pcm_oss_get_formats() has an obvious use-after-free around
snd_mask_test() calls, as spotted by syzbot.  The passed format_mask
argument is a pointer to the hw_params object that is freed before the
loop.  What a surprise that it has been present since the original
code of decades ago...

Reported-by: syzbot+4090700a4f13fccaf648@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

2018-03-11 10:25:10 +01:00

..

oss

ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()

2018-03-11 10:25:10 +01:00

seq

ALSA: seq: Clear client entry before deleting else at closing

2018-03-10 17:30:01 +01:00

compress_offload.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

control_compat.c

…

control.c

ALSA: control: Fix memory corruption risk in snd_ctl_elem_read

2018-02-28 08:15:56 +01:00

ctljack.c

…

device.c

…

hrtimer.c

…

hwdep_compat.c

…

hwdep.c

Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2018-01-31 09:25:20 -08:00

info_oss.c

…

info.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

init.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

isadma.c

…

jack.c

…

Kconfig

…

Makefile

…

memalloc.c

…

memory.c

…

misc.c

…

pcm_compat.c

…

pcm_dmaengine.c

…

pcm_drm_eld.c

…

pcm_iec958.c

…

pcm_lib.c

…

pcm_local.h

…

pcm_memory.c

…

pcm_misc.c

…

pcm_native.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

pcm_param_trace.h

…

pcm_timer.c

…

pcm_trace.h

…

pcm.c

…

rawmidi_compat.c

…

rawmidi.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

seq_device.c

…

sgbuf.c

…

sound_oss.c

…

sound.c

…

timer_compat.c

…

timer.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

vmaster.c

…