]> git.baikalelectronics.ru Git - kernel.git/commit
ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
authorHui Peng <benquike@gmail.com>
Mon, 3 Dec 2018 15:09:34 +0000 (16:09 +0100)
committerTakashi Iwai <tiwai@suse.de>
Mon, 3 Dec 2018 15:09:38 +0000 (16:09 +0100)
commita74d9878e7c6d5de3033fd74dab1962b8a5033c5
tree7da2be099988c205516860e9bfba4c839df67286
parentd92f66f7f9774b3cb53a1022ef2281a8444c07a5
ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c

If a USB sound card reports 0 interfaces, an error condition is triggered
and the function usb_audio_probe errors out. In the error path, there was a
use-after-free vulnerability where the memory object of the card was first
freed, followed by a decrement of the number of active chips. Moving the
decrement above the atomic_dec fixes the UAF.

[ The original problem was introduced in 3.1 kernel, while it was
  developed in a different form.  The Fixes tag below indicates the
  original commit but it doesn't mean that the patch is applicable
  cleanly. -- tiwai ]

Fixes: 26c1841dbdf8 ("ALSA: usb-audio - clear chip->probing on error exit")
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/usb/card.c