mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-28 15:20:41 +00:00
ALSA: bcd2000: Fix a UAF bug on the error path of probing
commitffb2759df7
upstream. When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug. The following log can reveal it: [ 50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] [ 50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] Fix this by adding usb_kill_urb() before usb_free_urb(). Fixes:b47a22290d
("ALSA: MIDI driver for Behringer BCD2000 USB device") Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220715010515.2087925-1-zheyuma97@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
9d9fc744c9
commit
4fc41f7ebb
1 changed files with 2 additions and 1 deletions
|
@ -357,7 +357,8 @@ static int bcd2000_init_midi(struct bcd2000 *bcd2k)
|
|||
static void bcd2000_free_usb_related_resources(struct bcd2000 *bcd2k,
|
||||
struct usb_interface *interface)
|
||||
{
|
||||
/* usb_kill_urb not necessary, urb is aborted automatically */
|
||||
usb_kill_urb(bcd2k->midi_out_urb);
|
||||
usb_kill_urb(bcd2k->midi_in_urb);
|
||||
|
||||
usb_free_urb(bcd2k->midi_out_urb);
|
||||
usb_free_urb(bcd2k->midi_in_urb);
|
||||
|
|
Loading…
Reference in a new issue