mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-28 15:20:41 +00:00
Code Issues Releases Wiki Activity
linux-stable/sound/isa
History
Lv Yunlong 8fb8803031 ALSA: sb: Fix two use after free in snd_sb_qsound_build 
commit 4fb44dd2c1 upstream.

In snd_sb_qsound_build, snd_ctl_add(..,p->qsound_switch...) and
snd_ctl_add(..,p->qsound_space..) are called. But the second
arguments of snd_ctl_add() could be freed via snd_ctl_add_replace()
->snd_ctl_free_one(). After the error code is returned,
snd_sb_qsound_destroy(p) is called in __error branch.

But in snd_sb_qsound_destroy(), the freed p->qsound_switch and
p->qsound_space are still used by snd_ctl_remove().

My patch set p->qsound_switch and p->qsound_space to NULL if
snd_ctl_add() failed to avoid the uaf bugs. But these codes need
to further be improved with the code style.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210426145541.8070-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-22 10:57:20 +02:00
..
ad1816a ALSA: isa: make snd_pcm_hardware const 2017-08-17 12:44:11 +02:00
ad1848
cs423x ALSA: cs4236: fix error return comparison of an unsigned integer 2020-01-09 10:17:56 +01:00
es1688 ALSA: es1688: Add the missed snd_card_free() 2020-06-20 10:25:00 +02:00
galaxy
gus License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
msnd ALSA: msnd: Fix the default sample sizes 2018-09-26 08:37:59 +02:00
opti9xx ALSA: opti9xx: shut up gcc-10 range warning 2020-05-05 19:15:52 +02:00
sb ALSA: sb: Fix two use after free in snd_sb_qsound_build 2021-05-22 10:57:20 +02:00
wavefront ALSA: isa/wavefront: prevent out of bounds write in ioctl 2020-06-25 15:41:48 +02:00
wss ALSA: wss: Fix invalid snd_free_pages() at error path 2018-12-05 19:41:24 +01:00
adlib.c
als100.c
azt2320.c
cmi8328.c
cmi8330.c
es18xx.c ALSA: isa: make snd_pcm_hardware const 2017-08-17 12:44:11 +02:00
Kconfig
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
opl3sa2.c
sc6000.c
sscape.c