ALSA: mixer: oss: Fix racy access to slots
authorTakashi Iwai <tiwai@suse.de>
Wed, 20 Oct 2021 16:48:46 +0000 (18:48 +0200)
committerTakashi Iwai <tiwai@suse.de>
Thu, 21 Oct 2021 05:03:47 +0000 (07:03 +0200)
commit411cef6adfb38a5bb6bd9af3941b28198e7fb680
treec4a5edfafc36ef46e1fe1ca2fb0a4bbbe98773b7
parent29664923725a384dc7e0f74af7c66e5ab7bb2a26
ALSA: mixer: oss: Fix racy access to slots

The OSS mixer can reassign the mapping slots dynamically via proc
file.  Although the addition and deletion of those slots are protected
by mixer->reg_mutex, the access to slots aren't, hence this may cause
UAF when the slots in use are deleted concurrently.

This patch applies the mixer->reg_mutex in all appropriate code paths
(i.e. the ioctl functions) that may access slots.

Reported-by: syzbot+9988f17cf72a1045a189@syzkaller.appspotmail.com
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/00000000000036adc005ceca9175@google.com
Link: https://lore.kernel.org/r/20211020164846.922-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/oss/mixer_oss.c