Correct commit id reference, actually take from linus tree

Gbp-Dch: Ignore
This commit is contained in:
Salvatore Bonaccorso 2018-03-09 11:58:43 +01:00
parent 5bd62d6357
commit 999a1d81ab
1 changed files with 2 additions and 5 deletions

View File

@ -4,11 +4,9 @@ Subject: ALSA: seq: Fix racy pool initializations
MIME-Version: 1.0 MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8 Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit
Origin: https://git.kernel.org/linus/3b8e84c8373de4e068e282102425d498d992e49b Origin: https://git.kernel.org/linus/d15d662e89fc667b90cd294b0eb45694e33144da
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-7566 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-7566
commit d15d662e89fc667b90cd294b0eb45694e33144da upstream.
ALSA sequencer core initializes the event pool on demand by invoking ALSA sequencer core initializes the event pool on demand by invoking
snd_seq_pool_init() when the first write happens and the pool is snd_seq_pool_init() when the first write happens and the pool is
empty. Meanwhile user can reset the pool size manually via ioctl empty. Meanwhile user can reset the pool size manually via ioctl
@ -23,13 +21,12 @@ mutex, we can avoid the race.
Reported-by: 范龙飞 <long7573@126.com> Reported-by: 范龙飞 <long7573@126.com>
Cc: <stable@vger.kernel.org> Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
--- ---
sound/core/seq/seq_clientmgr.c | 8 ++++++-- sound/core/seq/seq_clientmgr.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-) 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index d01913404581..a42cbbf2c8d9 100644 index 60db32785f62..04d4db44fae5 100644
--- a/sound/core/seq/seq_clientmgr.c --- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c
@@ -1003,7 +1003,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, @@ -1003,7 +1003,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,