Messages in this thread Patch in this message | | | Date | Thu, 31 Mar 2016 11:50:25 +0200 | From | Takashi Iwai <> | Subject | Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() |
| |
On Wed, 30 Mar 2016 22:31:15 +0200, Takashi Iwai wrote: > > On Wed, 30 Mar 2016 21:03:22 +0200, > Vladis Dronov wrote: > > > > There is a double-free bug in [snd-usb-audio] module due to alloc/free logic > > flaw in snd_usb_add_audio_stream() function. This leads to kernel structures > > corruption and panic. Fix the code flow and alloc/free logic so there is no > > double-free. > > > > The detailed analysis: https://bugzilla.redhat.com/show_bug.cgi?id=1283358 > > > > Reported-by: Ralf Spenneberg <ralf@spenneberg.net> > > Signed-off-by: Vladis Dronov <vdronov@redhat.com> > > Thanks for the report. But how about a simpler fix like below?
Maybe the one below is more straightforward (and even simpler). Let me know if this works enough for you.
thanks,
Takashi
-- 8< -- From: Takashi Iwai <tiwai@suse.de> Subject: [PATCH] ALSA: usb-audio: Fix double free in create_fixed_stream_quirk() error paths
create_fixed_stream_quirk() function allocates the audioformat object by itself and frees it upon error before returning. However, once when the object is linked to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be double-freed, eventually resulting in a memory corruption.
This patch fixes this failure in the error path by unlinking the audioformat object before freeing it.
[Note for stable backports: this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()')]
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Reported-by: Vladis Dronov <vdronov@redhat.com> Cc: <stable@vger.kernel.org> # see the note above Signed-off-by: Takashi Iwai <tiwai@suse.de> --- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index fb62bce2435c..a5a9ecaafb37 100644 --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, usb_audio_err(chip, "cannot memdup\n"); return -ENOMEM; } + INIT_LIST_HEAD(&fp->list); if (fp->nr_rates > MAX_NR_RATES) { kfree(fp); return -EINVAL; @@ -193,6 +194,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, return 0; error: + list_del(&fp->list); /* unlink for avoiding double-free */ kfree(fp); kfree(rate_table); return err; -- 2.7.4
| |