Hello,
I tested this patch with the reproducer and the crash did not trigger again.
On Mon, Sep 19, 2022 at 5:24 PM Takashi Iwai tiwai@suse.de wrote:
On Mon, 19 Sep 2022 10:30:54 +0200, Takashi Iwai wrote:
On Sun, 18 Sep 2022 15:01:11 +0200, Rondreis wrote:
Hello,
When fuzzing the Linux kernel driver v6.0-rc4, the following crash was triggered.
HEAD commit: 7e18e42e4b280c85b76967a9106a13ca61c16179 git tree: upstream
kernel config: https://pastebin.com/raw/xtrgsXP3 C reproducer: https://pastebin.com/raw/w2sdQWYj console output: https://pastebin.com/raw/Yyf7zw2d
Basically, in the c reproducer, we use the gadget module to emulate attaching a USB device(vendor id: 0x1bc7, product id: 0x1206, with the midi function) and executing some simple sequence of system calls. To reproduce this crash, we utilize a third-party library to emulate the attaching process: https://github.com/linux-usb-gadgets/libusbgx. Just clone this repository, install it, and compile the c reproducer with ``` gcc crash.c -lusbgx -lconfig -o crash ``` will do the trick.
I would appreciate it if you have any idea how to solve this bug.
Could you try the patch below? It looks like a simple double-free in the code.
A more proper patch is below. Please give it a try.
thanks,
Takashi
-- 8< -- From: Takashi Iwai tiwai@suse.de Subject: [PATCH] ALSA: core: Fix double-free at snd_card_new()
During the code change to add the support for devres-managed card instance, we put an explicit kfree(card) call at the error path in snd_card_new(). This is needed for the early error path before the card is initialized with the device, but is rather superfluous and causes a double-free at the error path after the card instance is initialized, as the destructor of the card object already contains a kfree() call.
This patch fixes the double-free situation by removing the superfluous kfree(). Meanwhile we need to call kfree() explicitly for the early error path, so it's added there instead.
Fixes: e8ad415b7a55 ("ALSA: core: Add managed card creation") Reported-by: Rondreis linhaoguo86@gmail.com Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/CAB7eexL1zBnB636hwS27d-LdPYZ_R1-5fJS_h=ZbCWYU=UPWJ... Signed-off-by: Takashi Iwai tiwai@suse.de
sound/core/init.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/sound/core/init.c b/sound/core/init.c index 193dae361fac..5377f94eb211 100644 --- a/sound/core/init.c +++ b/sound/core/init.c @@ -178,10 +178,8 @@ int snd_card_new(struct device *parent, int idx, const char *xid, return -ENOMEM;
err = snd_card_init(card, parent, idx, xid, module, extra_size);
if (err < 0) {kfree(card);return err;}
if (err < 0)return err; /* card is freed by error handler */ *card_ret = card; return 0;@@ -233,7 +231,7 @@ int snd_devm_card_new(struct device *parent, int idx, const char *xid, card->managed = true; err = snd_card_init(card, parent, idx, xid, module, extra_size); if (err < 0) {
devres_free(card);
devres_free(card); /* in managed mode, we need to free manually */ return err; }@@ -297,6 +295,8 @@ static int snd_card_init(struct snd_card *card, struct device *parent, mutex_unlock(&snd_card_mutex); dev_err(parent, "cannot find the slot for index %d (range 0-%i), error: %d\n", idx, snd_ecards_limit - 1, err);
if (!card->managed)kfree(card); /* manually free here, as no destructor called */ return err; } set_bit(idx, snd_cards_lock); /* lock it */-- 2.35.3