sound: Drain buffer selinfo in sndbuf_free()
ClosedPublic
Actions

Authored by christos on Mar 28 2024, 5:15 AM.

Details

Reviewers

markj
emaste
dev_submerge.ch
imp

Commits

rGea2275e72cda: sound: Drain buffer selinfo in sndbuf_free()
rGfba54d0179aa: sound: Drain buffer selinfo in sndbuf_free()

Summary

Prevent a use-after-free in kern_poll() by making sure the buffer's
selinfo is drained.

Reported by: KASAN
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

christos requested review of this revision.Mar 28 2024, 5:15 AM

christos created this revision.

Harbormaster completed remote builds in B56818: Diff 136299.Mar 28 2024, 5:15 AM

christos mentioned this in D43545: sound: Implement asynchronous device detach.Mar 28 2024, 5:16 AM

christos added a child revision: D43545: sound: Implement asynchronous device detach.

christos retitled this revision from sound: drain buffer selinfo during sndbuf_free() to sound: Drain buffer selinfo in sndbuf_free().Mar 28 2024, 5:18 AM

In the commit message, you should note that this is only required with async detach.

This revision is now accepted and ready to land.Fri, Mar 29, 2:43 PM

Closed by commit rGfba54d0179aa: sound: Drain buffer selinfo in sndbuf_free() (authored by christos). · Explain WhyFri, Mar 29, 3:33 PM

This revision was automatically updated to reflect the committed changes.

christos added a commit: rGfba54d0179aa: sound: Drain buffer selinfo in sndbuf_free().

christos removed a child revision: D43545: sound: Implement asynchronous device detach.Thu, Apr 11, 4:13 PM

christos added a commit: rGea2275e72cda: sound: Drain buffer selinfo in sndbuf_free().Fri, Apr 12, 1:13 AM

Revision Contents
Changeset List

Path

Size

sys/

dev/

sound/

pcm/

buffer.c

1 line

Diff 136327

View Options

sys/dev/sound/pcm/buffer.c

sound: Drain buffer selinfo in sndbuf_free()ClosedPublicActions