Messages in this thread | | | Date | Mon, 26 Apr 2021 18:01:26 +0200 | From | Takashi Iwai <> | Subject | Re: [PATCH] sound/isa/ib: Fix two use after free in snd_sb_qsound_build |
| |
On Mon, 26 Apr 2021 16:55:41 +0200, Lv Yunlong wrote: > > In snd_sb_qsound_build, snd_ctl_add(..,p->qsound_switch...) and > snd_ctl_add(..,p->qsound_space..) are called. But the second > arguments of snd_ctl_add() could be freed via snd_ctl_add_replace() > ->snd_ctl_free_one(). After the error code is returned, > snd_sb_qsound_destroy(p) is called in __error branch. > > But in snd_sb_qsound_destroy(), the freed p->qsound_switch and > p->qsound_space are still used by snd_ctl_remove(). > > My patch set p->qsound_switch and p->qsound_space to NULL if > snd_ctl_add() failed to avoid the uaf bugs. But these codes need > to further be improved with the code style. > > Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Thanks, applied now.
Takashi
| |