On Wed, 30 Mar 2016 22:31:15 +0200, Takashi Iwai wrote:
On Wed, 30 Mar 2016 21:03:22 +0200, Vladis Dronov wrote:
There is a double-free bug in [snd-usb-audio] module due to alloc/free logic flaw in snd_usb_add_audio_stream() function. This leads to kernel structures corruption and panic. Fix the code flow and alloc/free logic so there is no double-free.
The detailed analysis: https://bugzilla.redhat.com/show_bug.cgi?id=1283358
Reported-by: Ralf Spenneberg ralf@spenneberg.net Signed-off-by: Vladis Dronov vdronov@redhat.com
Thanks for the report. But how about a simpler fix like below?
Maybe the one below is more straightforward (and even simpler). Let me know if this works enough for you.
thanks,
Takashi
-- 8< -- From: Takashi Iwai tiwai@suse.de Subject: [PATCH] ALSA: usb-audio: Fix double free in create_fixed_stream_quirk() error paths
create_fixed_stream_quirk() function allocates the audioformat object by itself and frees it upon error before returning. However, once when the object is linked to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be double-freed, eventually resulting in a memory corruption.
This patch fixes this failure in the error path by unlinking the audioformat object before freeing it.
[Note for stable backports: this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()')]
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358 Reported-by: Ralf Spenneberg ralf@spenneberg.net Reported-by: Vladis Dronov vdronov@redhat.com Cc: stable@vger.kernel.org # see the note above Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index fb62bce2435c..a5a9ecaafb37 100644 --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, usb_audio_err(chip, "cannot memdup\n"); return -ENOMEM; } + INIT_LIST_HEAD(&fp->list); if (fp->nr_rates > MAX_NR_RATES) { kfree(fp); return -EINVAL; @@ -193,6 +194,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, return 0;
error: + list_del(&fp->list); /* unlink for avoiding double-free */ kfree(fp); kfree(rate_table); return err;