On Sat, Nov 13, 2021 at 04:38:45PM +0100, Takashi Iwai wrote: > commit 411cef6adfb38a5bb6bd9af3941b28198e7fb680 upstream. > > The OSS mixer can reassign the mapping slots dynamically via proc > file. Although the addition and deletion of those slots are protected > by mixer->reg_mutex, the access to slots aren't, hence this may cause > UAF when the slots in use are deleted concurrently. > > This patch applies the mixer->reg_mutex in all appropriate code paths > (i.e. the ioctl functions) that may access slots. > > Reported-by: syzbot+9988f17cf72a1045a189@xxxxxxxxxxxxxxxxxxxxxxxxx > Reviewed-by: Jaroslav Kysela <perex@xxxxxxxx> > Cc: <stable@xxxxxxxxxxxxxxx> > Link: https://lore.kernel.org/r/00000000000036adc005ceca9175@xxxxxxxxxx > Link: https://lore.kernel.org/r/20211020164846.922-1-tiwai@xxxxxxx > Signed-off-by: Takashi Iwai <tiwai@xxxxxxx> > --- > > Please apply to older stable kernels, too Both now queued up, thanks! greg k-h
