FEX-Emu/linux
1
0
Fork 0
mirror of https://github.com/FEX-Emu/linux.git synced 2024-12-27 03:47:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
21c3ba7e5d
linux/sound/usb
History
Takashi Iwai 6ff1a25318 ALSA: usb-audio: Fix use-after-free of usb_device at disconnect 
The usb-audio driver implements the deferred device disconnection for
the device in use.  In this mode, the disconnection callback returns
immediately while the actual ALSA card object removal happens later
when all files get closed.  As Shuah reported, this code flow,
however, leads to a use-after-free, detected by KASAN:

 BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
 Write of size 8 by task pulseaudio/2244
 Call Trace:
  [<ffffffff81b31473>] dump_stack+0x67/0x94
  [<ffffffff81564ef1>] kasan_object_err+0x21/0x70
  [<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0
  [<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0
  [<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50
  [<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
  [<ffffffff8243c78a>] __snd_device_free+0x12a/0x210
  [<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0
  [<ffffffff8242cae4>] release_card_device+0x34/0x130
  [<ffffffff81ef1846>] device_release+0x76/0x1e0
  [<ffffffff81b37ad7>] kobject_release+0x107/0x370
  .....
 Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
 Allocated:
  [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
  [<ffffffff81564296>] save_stack+0x46/0xd0
  [<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0
  [<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240
  [<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90
  [<ffffffff8216349d>] hub_event+0xf1d/0x35f0
  ....
 Freed:
  [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
  [<ffffffff81564296>] save_stack+0x46/0xd0
  [<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0
  [<ffffffff81560929>] kfree+0xd9/0x280
  [<ffffffff8214de6e>] usb_release_dev+0xde/0x110
  [<ffffffff81ef1846>] device_release+0x76/0x1e0
  ....

It's the code trying to clear drvdata of the assigned usb_device where
the usb_device itself was already released in usb_release_dev() after
the disconnect callback.

This patch fixes it by checking whether the code path is via the
disconnect callback, i.e. chip->shutdown flag is set.

Fixes: 79289e2419 ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
Reported-and-tested-by: Shuah Khan <shuahkh@osg.samsung.com>
Cc: <stable@vger.kernel.org> # v4.6+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-11-14 22:05:04 +01:00
..
6fire treewide: Fix typos in printk 2015-12-08 14:59:19 +01:00
bcd2000
caiaq ALSA: usb: caiaq: audio: don't print error when allocating urb fails 2016-08-11 23:05:57 +02:00
hiface
line6 ALSA: line6: fix a crash in line6_hwdep_write() 2016-10-12 20:10:23 +02:00
misc ALSA: ua101: replace le16_to_cpu() with usb_endpoint_maxp() 2015-11-16 09:03:06 +01:00
usx2y ALSA: usx2y: fix inconsistent indenting on if statement 2015-12-02 18:03:24 +01:00
card.c ALSA: usb-audio: Fix use-after-free of usb_device at disconnect 2016-11-14 22:05:04 +01:00
card.h ALSA: usb: use TEAC UD-H01 quirk for more devices 2016-08-22 11:39:56 +02:00
clock.c ALSA: usb-audio: Limit retrying sample rate reads 2016-04-29 11:49:04 +02:00
clock.h
debug.h
endpoint.c ALSA: usb: fine-tune Tenor error compensation value 2016-08-22 11:40:04 +02:00
endpoint.h
format.c ALSA: usb-audio: rmove print for failure of kmalloc 2016-08-22 11:41:02 +02:00
format.h
helper.c ALSA: usb-audio: correct speed checking 2016-05-08 11:42:04 +02:00
helper.h
Kconfig [media] Revert "[media] sound/usb: Use Media Controller API to share media resources" 2016-03-31 15:02:33 -03:00
Makefile [media] Revert "[media] sound/usb: Use Media Controller API to share media resources" 2016-03-31 15:02:33 -03:00
midi.c ALSA: usb-midi: correct speed checking 2016-05-08 11:42:30 +02:00
midi.h ALSA: usb-audio: Refer to chip->usb_id for quirks and MIDI creation 2016-01-29 07:36:10 +01:00
mixer_maps.c ALSA: usb-audio: Change structure initialisation to C99 style 2016-06-17 16:58:41 +02:00
mixer_quirks.c ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants 2016-09-23 08:32:18 +02:00
mixer_quirks.h ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly 2015-12-14 10:13:17 +01:00
mixer_scarlett.c
mixer_scarlett.h
mixer.c ALSA: usb-audio: allow clock source validity interrupts 2016-04-09 17:22:40 +02:00
mixer.h [media] Revert "[media] sound/usb: Use Media Controller API to share media resources" 2016-03-31 15:02:33 -03:00
pcm.c [media] Revert "[media] sound/usb: Use Media Controller API to share media resources" 2016-03-31 15:02:33 -03:00
pcm.h
power.h
proc.c ALSA: usb-audio: Avoid nested autoresume calls 2015-08-26 15:38:25 +02:00
proc.h
quirks-table.h ALSA: usb-audio: Add quirk for Syntek STK1160 2016-10-27 12:07:19 +02:00
quirks.c Merge branch 'for-linus' into for-next 2016-09-11 09:33:12 +02:00
quirks.h ALSA: usb-audio: Refer to chip->usb_id for quirks and MIDI creation 2016-01-29 07:36:10 +01:00
stream.c media fixes for v4.6-rc2 2016-04-05 06:47:50 -07:00
stream.h
usbaudio.h Merge branch 'for-linus' into for-next 2016-05-10 16:06:04 +02:00