linux-stable/sound
Clemens Ladisch 28b4c9130b ALSA: rawmidi: fix oops (use after free) when unloading a driver module
commit aa73aec6c3 upstream.

When a driver module is unloaded and the last still open file is a raw
MIDI device, the card and its devices will be actually freed in the
snd_card_file_remove() call when that file is closed.  Afterwards, rmidi
and rmidi->card point into freed memory, so the module pointer is likely
to be garbage.
(This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.)

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Reported-by: Krzysztof Foltman <wdev@foltman.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-10-28 21:43:53 -07:00
..
aoa ALSA: Don't assume i2c device probing always succeeds 2009-10-01 07:46:33 +02:00
arm ALSA: AACI: fix recording bug 2009-11-30 14:50:55 +01:00
atmel ALSA: snd-atmel-abdac: increase periods_min to 6 instead of 4 2009-04-06 03:56:28 +02:00
core ALSA: rawmidi: fix oops (use after free) when unloading a driver module 2010-10-28 21:43:53 -07:00
drivers ALSA: dummy - Fix descriptions of pcm_substreams parameter 2009-11-02 14:11:55 +01:00
i2c V4L/DVB (10771): tea575x-tuner: convert it to V4L2 API 2009-03-30 12:43:02 -03:00
isa Merge branch 'topic/cmi8330' into for-linus 2009-09-10 15:32:45 +02:00
mips sound: sgio2audio/pdaudiocf/usb-audio: initialize PCM buffer 2010-01-06 15:03:26 -08:00
oss Merge branch 'hostprogs-wmissing-prototypes' of git://git.kernel.org/pub/scm/linux/kernel/git/josh/linux-misc 2009-11-17 09:14:49 -08:00
parisc ALSA: sound/parisc: Move dereference after NULL test 2009-10-30 12:01:38 +01:00
pci ALSA: hda - Add Dell Latitude E6400 model quirk 2010-10-28 21:43:52 -07:00
pcmcia sound: sgio2audio/pdaudiocf/usb-audio: initialize PCM buffer 2010-01-06 15:03:26 -08:00
ppc powerpc: Minor cleanup to sound/ppc/Kconfig 2009-10-27 16:42:42 +11:00
sh ALSA: snd-aica: declare MODULE_FIRMWARE 2009-11-08 09:13:51 +01:00
soc ASoC: Remove DSP mode support for WM8776 2010-08-26 16:41:33 -07:00
sparc ALSA: Add missing SNDRV_PCM_INFO_BATCH flag to some drivers 2009-04-28 15:06:44 +02:00
spi ALSA: Convert to snd_card_create() in other sound/* 2009-01-12 15:21:19 +01:00
synth ALSA: clean up the logic for building sequencer modules 2009-05-29 11:49:42 +02:00
usb ALSA: usb - Fix Oops after usb-midi disconnection 2010-04-26 07:41:25 -07:00
ac97_bus.c ALSA: ac97 - Include ac97_codec.h for ac97_bus_type declaration 2008-12-02 16:25:37 +01:00
Kconfig sound: make OSS device number claiming optional and schedule its removal 2009-08-10 13:59:36 +02:00
last.c [ALSA] Remove sound/driver.h 2008-01-31 17:29:48 +01:00
Makefile ALSA: Add Atmel ALSA drivers directory 2009-02-05 15:08:53 +01:00
sound_core.c Driver-Core: extend devnode callbacks to provide permissions 2009-09-19 12:50:38 -07:00
sound_firmware.c Detach sched.h from mm.h 2007-05-21 09:18:19 -07:00