Zheyu Ma 348620464a ALSA: bcd2000: Fix a UAF bug on the error path of probing ... commit ffb2759df7 upstream. When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug. The following log can reveal it: [ 50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] [ 50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] Fix this by adding usb_kill_urb() before usb_free_urb(). Fixes: b47a22290d ("ALSA: MIDI driver for Behringer BCD2000 USB device") Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220715010515.2087925-1-zheyuma97@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-08-21 15:15:18 +02:00
..
6fire	ALSA: 6fire: fix control and bulk message timeouts	2021-11-18 14:03:39 +01:00
bcd2000	ALSA: bcd2000: Fix a UAF bug on the error path of probing	2022-08-21 15:15:18 +02:00
caiaq	ALSA: Replace with fallthrough pseudo keyword in the remaining places	2020-07-09 19:10:43 +02:00
hiface	sound: hiface: move to use usb_control_msg_send()	2020-09-25 16:33:59 +02:00
line6	ALSA: line6: fix control and interrupt message timeouts	2021-11-18 14:03:39 +01:00
misc	ALSA: ua101: fix division by zero at probe	2021-11-18 14:03:39 +01:00
usx2y	ALSA: usx2y: Don't call free_pages_exact() with NULL address	2021-07-20 16:05:39 +02:00
card.c	ALSA: usb-audio: Fix superfluous autosuspend recovery	2021-08-12 13:22:10 +02:00
card.h	ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109	2020-08-10 12:57:12 +02:00
clock.c	ALSA: usb-audio: fix incorrect clock source setting	2021-08-12 13:22:03 +02:00
clock.h	ALSA: usb-audio: Add clock validity quirk for Denon MC7000/MCX8000	2020-02-13 07:18:58 +01:00
debug.h
endpoint.c	ALSA: usb-audio: Don't avoid stopping the stream at disconnection	2021-03-20 10:43:44 +01:00
endpoint.h	ALSA: usb-audio: Improve frames size computation	2020-04-24 08:25:24 +02:00
format.c	ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID	2022-01-27 10:54:06 +01:00
format.h
helper.c	USB: move snd_usb_pipe_sanity_check into the USB core	2020-09-16 11:02:23 +02:00
helper.h	USB: move snd_usb_pipe_sanity_check into the USB core	2020-09-16 11:02:23 +02:00
Kconfig	sound: Fix Kconfig indentation	2019-10-07 03:53:03 +02:00
Makefile	ALSA: usb-audio: Add support for Presonus Studio 1810c	2020-02-15 09:46:16 +01:00
media.c
media.h
midi.c	ALSA: usb-audio: Cancel pending work at closing a MIDI substream	2022-06-09 10:20:48 +02:00
midi.h
mixer.c	ALSA: usb-audio: Add missing proc text entry for BESPOKEN type	2021-07-28 14:35:42 +02:00
mixer.h	ALSA: usb-audio: scarlett2: Fix wrong resume call	2021-07-14 16:55:35 +02:00
mixer_maps.c	ALSA: usb-audio: add mapping for new Corsair Virtuoso SE	2022-03-28 09:57:08 +02:00
mixer_quirks.c	ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB	2022-03-28 09:57:09 +02:00
mixer_quirks.h
mixer_s1810c.c	ALSA: usb-audio: Fix some typos	2020-06-30 19:48:18 +02:00
mixer_s1810c.h	ALSA: usb-audio: Add support for Presonus Studio 1810c	2020-02-15 09:46:16 +01:00
mixer_scarlett.c	ALSA: usb-audio: More constifications	2020-01-05 16:14:34 +01:00
mixer_scarlett.h
mixer_scarlett_gen2.c	ALSA: usb-audio: scarlett2: Fix 6i6 Gen 2 line out descriptions	2021-07-20 16:05:45 +02:00
mixer_scarlett_gen2.h	ALSA: usb-audio: scarlett2: Improve driver startup messages	2021-06-03 09:00:27 +02:00
mixer_us16x08.c	ALSA: usb-audio: US16x08: fix value count for level meters	2020-11-27 14:56:40 +01:00
mixer_us16x08.h	ALSA: usb: Constify snd_kcontrol_new items	2020-01-03 09:24:34 +01:00
pcm.c	ALSA: usb-audio: Don't avoid stopping the stream at disconnection	2021-03-20 10:43:44 +01:00
pcm.h
power.c	ALSA: usb-audio: More validations of descriptor units	2019-08-22 10:35:59 +02:00
power.h
proc.c	ALSA: usb-audio: Fix a limit check in proc_dump_substream_formats()	2020-04-22 11:29:15 +02:00
proc.h
quirks-table.h	ALSA: usb-audio: Restore Rane SL-1 quirk	2022-05-25 09:17:55 +02:00
quirks.c	ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID	2022-01-27 10:54:06 +01:00
quirks.h	ALSA: usb-audio: Rewrite registration quirk handling	2020-03-26 10:47:00 +01:00
stream.c	ALSA: usb-audio: Fix control 'access overflow' errors from chmap	2020-12-21 13:30:07 +01:00
stream.h
usbaudio.h	ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant	2022-04-27 13:53:53 +02:00
validate.c	ALSA: usb-audio: Fix endianess in descriptor validation	2020-02-01 09:06:11 +01:00