[alsa-devel] [PATCH] ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()

[Takashi Iwai]

On Fri, 01 Jun 2018 00:35:18 +0200,
Bo Chen wrote:
> 
> When 'kzalloc()' fails in 'snd_hda_attach_pcm_stream()', a new pcm instance is
> created without setting its operators via 'snd_pcm_set_ops()'. Following
> operations on the new pcm instance can trigger kernel null pointer dereferences
> and cause kernel oops.
> 
> This bug was found with my work on building a gray-box fault-injection tool for
> linux-kernel-module binaries. A kernel null pointer dereference was confirmed
> from line 'substream->ops->open()' in function 'snd_pcm_open_substream()' in
> file 'sound/core/pcm_native.c'.
> 
> This patch fixes the bug by calling 'snd_device_free()' in the error handling
> path of 'kzalloc()', which removes the new pcm instance from the snd card before
> returns with an error code.
> 
> Signed-off-by: Bo Chen <chenbo at pdx.edu>

Applied now.  Thanks.


Takashi