ALSA: seq: Fix race at creating a queue

When a sequencer queue is created in snd_seq_queue_alloc(),it adds the
new queue element to the public list before referencing it.  Thus the
queue might be deleted before the call of snd_seq_queue_use(), and it
results in the use-after-free error, as spotted by syzkaller.

The fix is to reference the queue object at the right time.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

1 files changed, 20 insertions, 13 deletions

diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c

path: root/curvetun_mgmt.h

#ifndef CURVETUN_MGMT_H
#define CURVETUN_MGMT_H

#include "curvetun_mgmt_servers.h"
#include "curvetun_mgmt_users.h"

#endif /* CURVETUN_MGMT_H */