lkml.org 
[lkml]   [2022]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [BUG] media: cx88-alsa: Found a bug at the probe time
From
Hi--

On 7/14/22 18:54, Zheyu Ma wrote:
> Hello,
>
> I found a bug in the driver cx88-alsa.
>
> When the driver fails in the function snd_cx88_create() at the probe
> time, it will cause a UAF bug as follows:

It's not a UAF. It's a WARN() macro with an IRQ management problem,
as shown in the next 2 lines below:
>
> [ 24.343899] Trying to free already-free IRQ 0
> [ 24.344815] WARNING: CPU: 7 PID: 389 at kernel/irq/manage.c:1895
> free_irq+0x3a4/0x7c0
> [ 24.348448] RIP: 0010:free_irq+0x3a4/0x7c0
> [ 24.356716] Call Trace:
> [ 24.357124] snd_cx88_dev_free+0x71/0x100 [cx88_alsa]
> [ 24.358008] release_card_device+0x7d/0x190
> [ 24.358699] device_release+0x97/0x1c0
> [ 24.359022] kobject_put+0x144/0x1c0
> [ 24.359329] snd_card_free+0xec/0x150
> [ 24.360078] cx88_audio_initdev+0x8f4/0xce0 [cx88_alsa]
>
> Since I'm not familiar with the driver, could you please give me some
> hints to fix it?
>
> regards,
>
> Zheyu Ma

--
~Randy

\
 
 \ /
  Last update: 2022-07-16 21:05    [W:0.049 / U:0.156 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site