Takashi Iwai 2410490a14 ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open() ...

commit 27f7ad5382 upstream.

The error handling in snd_seq_oss_open() has several bad codes that
do dereferecing released pointers and double-free of kmalloc'ed data.
The object dp is release in free_devinfo() that is called via
private_free callback.  The rest shouldn't touch this object any more.

The patch changes delete_port() to call kfree() in any case, and gets
rid of unnecessary calls of destructors in snd_seq_oss_open().

Fixes CVE-2010-3080.

Reported-and-tested-by: Tavis Ormandy <taviso@cmpxchg8b.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2010-09-20 13:17:50 -07:00

..

oss

ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open()

2010-09-20 13:17:50 -07:00

Kconfig

ALSA: clean up the logic for building sequencer modules

2009-05-29 11:49:42 +02:00

Makefile

ALSA: OSS sequencer should be initialized after snd_seq_system_client_init

2009-07-19 19:10:01 +02:00

seq_clientmgr.c

ALSA: Kill snd_assert() in sound/core/*

2008-08-13 11:46:35 +02:00

seq_clientmgr.h

[ALSA] sound/core/seq: move declarations of globally visible variables to proper headers

2008-01-31 17:29:35 +01:00

seq_compat.c

ALSA: sound/core: use memdup_user()

2009-04-14 12:39:12 +02:00

seq_device.c

ALSA: Kill snd_assert() in sound/core/*

2008-08-13 11:46:35 +02:00

seq_dummy.c

[ALSA] Remove sound/driver.h

2008-01-31 17:29:48 +01:00

seq_fifo.c

ALSA: Kill snd_assert() in sound/core/*

2008-08-13 11:46:35 +02:00

seq_fifo.h

…

seq_info.c

[ALSA] Remove sound/driver.h

2008-01-31 17:29:48 +01:00

seq_info.h

…

seq_lock.c

[ALSA] Remove sound/driver.h

2008-01-31 17:29:48 +01:00

seq_lock.h

…

seq_memory.c

ALSA: Kill snd_assert() in sound/core/*

2008-08-13 11:46:35 +02:00

seq_memory.h

…

seq_midi_emul.c

[ALSA] Remove sound/driver.h

2008-01-31 17:29:48 +01:00

seq_midi_event.c

sound: seq_midi_event: fix decoding of (N)RPN events

2009-06-22 11:11:49 +02:00

seq_midi.c

sound: rawmidi: disable active-sensing-on-close by default

2009-07-15 11:57:20 +02:00

seq_ports.c

ALSA: Kill snd_assert() in sound/core/*

2008-08-13 11:46:35 +02:00

seq_ports.h

…

seq_prioq.c

ALSA: Add missing KERN_* prefix to printk in sound/core

2009-02-05 16:00:49 +01:00

seq_prioq.h

…

seq_queue.c

ALSA: Kill snd_assert() in sound/core/*

2008-08-13 11:46:35 +02:00

seq_queue.h

…

seq_system.c

[ALSA] Remove sound/driver.h

2008-01-31 17:29:48 +01:00

seq_system.h

…

seq_timer.c

ALSA: Kill snd_assert() in sound/core/*

2008-08-13 11:46:35 +02:00

seq_timer.h

[ALSA] sound/core/seq: move declarations of globally visible variables to proper headers

2008-01-31 17:29:35 +01:00

seq_virmidi.c

[ALSA] Remove sound/driver.h

2008-01-31 17:29:48 +01:00

seq.c

ALSA: Add hrtimer backend for ALSA timer interface

2008-10-24 18:16:50 +02:00