Go to file
Zheyu Ma 05e0bb8c3c ALSA: bcd2000: Fix a UAF bug on the error path of probing
commit ffb2759df7 upstream.

When the driver fails in snd_card_register() at probe time, it will free
the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug.

The following log can reveal it:

[   50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]
[   50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0
[   50.729530] Call Trace:
[   50.732899]  bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]

Fix this by adding usb_kill_urb() before usb_free_urb().

Fixes: b47a22290d ("ALSA: MIDI driver for Behringer BCD2000 USB device")
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220715010515.2087925-1-zheyuma97@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-25 11:17:17 +02:00
Documentation x86/speculation: Add RSB VM Exit protections 2022-08-11 12:57:53 +02:00
LICENSES
arch x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments 2022-08-25 11:17:17 +02:00
block block: fix bio_clone_blkg_association() to associate with proper blkcg_gq 2022-06-14 18:11:50 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:11:22 +02:00
crypto crypto: drbg - make reseeding from get_random_bytes() synchronous 2022-06-22 14:11:18 +02:00
drivers scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover" 2022-08-25 11:17:17 +02:00
fs ntfs: fix use-after-free in ntfs_ucsncmp() 2022-08-03 11:59:37 +02:00
include ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr 2022-08-03 11:59:39 +02:00
init random: handle latent entropy and command line from random_init() 2022-06-22 14:11:17 +02:00
ipc ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() 2022-06-14 18:11:41 +02:00
kernel bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() 2022-08-11 12:57:51 +02:00
lib locking/refcount: Consolidate implementations of refcount_t 2022-07-29 17:14:17 +02:00
mm mm/mempolicy: fix uninit-value in mpol_rebind_policy() 2022-07-29 17:14:16 +02:00
net sctp: leave the err path free in sctp_stream_init to sctp_stream_free 2022-08-03 11:59:41 +02:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-17 09:48:39 +01:00
scripts modpost: fix section mismatch check for exported init/exit sections 2022-06-29 08:58:49 +02:00
security ima: remove the IMA_TEMPLATE Kconfig option 2022-07-29 17:14:16 +02:00
sound ALSA: bcd2000: Fix a UAF bug on the error path of probing 2022-08-25 11:17:17 +02:00
tools x86/speculation: Add RSB VM Exit protections 2022-08-11 12:57:53 +02:00
usr
virt KVM: Don't null dereference ops->destroy 2022-08-11 12:57:52 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS MAINTAINERS: co-maintain random.c 2022-06-22 14:11:05 +02:00
Makefile Makefile: link with -z noexecstack --no-warn-rwx-segments 2022-08-25 11:17:17 +02:00
README

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.