On Mon, 19 Sep 2022 13:46:43 +0200, Rondreis wrote:
Hello,
I tested this patch with the reproducer and the crash did not trigger again.
Thanks for quick testing. I'm going to submit and merge the fix, then.
Takashi
On Mon, Sep 19, 2022 at 5:24 PM Takashi Iwai tiwai@suse.de wrote:
On Mon, 19 Sep 2022 10:30:54 +0200, Takashi Iwai wrote:
On Sun, 18 Sep 2022 15:01:11 +0200, Rondreis wrote:
Hello,
When fuzzing the Linux kernel driver v6.0-rc4, the following crash was triggered.
HEAD commit: 7e18e42e4b280c85b76967a9106a13ca61c16179 git tree: upstream
kernel config: https://pastebin.com/raw/xtrgsXP3 C reproducer: https://pastebin.com/raw/w2sdQWYj console output: https://pastebin.com/raw/Yyf7zw2d
Basically, in the c reproducer, we use the gadget module to emulate attaching a USB device(vendor id: 0x1bc7, product id: 0x1206, with the midi function) and executing some simple sequence of system calls. To reproduce this crash, we utilize a third-party library to emulate the attaching process: https://github.com/linux-usb-gadgets/libusbgx. Just clone this repository, install it, and compile the c reproducer with ``` gcc crash.c -lusbgx -lconfig -o crash ``` will do the trick.
I would appreciate it if you have any idea how to solve this bug.
Could you try the patch below? It looks like a simple double-free in the code.
A more proper patch is below. Please give it a try.
thanks,
Takashi
-- 8< -- From: Takashi Iwai tiwai@suse.de Subject: [PATCH] ALSA: core: Fix double-free at snd_card_new()
During the code change to add the support for devres-managed card instance, we put an explicit kfree(card) call at the error path in snd_card_new(). This is needed for the early error path before the card is initialized with the device, but is rather superfluous and causes a double-free at the error path after the card instance is initialized, as the destructor of the card object already contains a kfree() call.
This patch fixes the double-free situation by removing the superfluous kfree(). Meanwhile we need to call kfree() explicitly for the early error path, so it's added there instead.
Fixes: e8ad415b7a55 ("ALSA: core: Add managed card creation") Reported-by: Rondreis linhaoguo86@gmail.com Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/CAB7eexL1zBnB636hwS27d-LdPYZ_R1-5fJS_h=ZbCWYU=UPWJ... Signed-off-by: Takashi Iwai tiwai@suse.de
sound/core/init.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/sound/core/init.c b/sound/core/init.c index 193dae361fac..5377f94eb211 100644 --- a/sound/core/init.c +++ b/sound/core/init.c @@ -178,10 +178,8 @@ int snd_card_new(struct device *parent, int idx, const char *xid, return -ENOMEM;
err = snd_card_init(card, parent, idx, xid, module, extra_size);
if (err < 0) {
kfree(card);
return err;
}
if (err < 0)
return err; /* card is freed by error handler */ *card_ret = card; return 0;
@@ -233,7 +231,7 @@ int snd_devm_card_new(struct device *parent, int idx, const char *xid, card->managed = true; err = snd_card_init(card, parent, idx, xid, module, extra_size); if (err < 0) {
devres_free(card);
devres_free(card); /* in managed mode, we need to free manually */ return err; }
@@ -297,6 +295,8 @@ static int snd_card_init(struct snd_card *card, struct device *parent, mutex_unlock(&snd_card_mutex); dev_err(parent, "cannot find the slot for index %d (range 0-%i), error: %d\n", idx, snd_ecards_limit - 1, err);
if (!card->managed)
kfree(card); /* manually free here, as no destructor called */ return err; } set_bit(idx, snd_cards_lock); /* lock it */
-- 2.35.3