lkml.org 
[lkml]   [2021]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] sound/isa/ib: Fix two use after free in snd_sb_qsound_build
On Mon, 26 Apr 2021 16:55:41 +0200,
Lv Yunlong wrote:
>
> In snd_sb_qsound_build, snd_ctl_add(..,p->qsound_switch...) and
> snd_ctl_add(..,p->qsound_space..) are called. But the second
> arguments of snd_ctl_add() could be freed via snd_ctl_add_replace()
> ->snd_ctl_free_one(). After the error code is returned,
> snd_sb_qsound_destroy(p) is called in __error branch.
>
> But in snd_sb_qsound_destroy(), the freed p->qsound_switch and
> p->qsound_space are still used by snd_ctl_remove().
>
> My patch set p->qsound_switch and p->qsound_space to NULL if
> snd_ctl_add() failed to avoid the uaf bugs. But these codes need
> to further be improved with the code style.
>
> Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>

Thanks, applied now.


Takashi

\
 
 \ /
  Last update: 2021-04-26 18:01    [W:0.103 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site