mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-22 18:41:06 +00:00
Code Issues Releases Wiki Activity
linux-stable/sound/usb
History
Zheyu Ma 64ca7f50ad ALSA: bcd2000: Fix a UAF bug on the error path of probing 
commit ffb2759df7 upstream.

When the driver fails in snd_card_register() at probe time, it will free
the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug.

The following log can reveal it:

[   50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]
[   50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0
[   50.729530] Call Trace:
[   50.732899]  bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]

Fix this by adding usb_kill_urb() before usb_free_urb().

Fixes: b47a22290d ("ALSA: MIDI driver for Behringer BCD2000 USB device")
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220715010515.2087925-1-zheyuma97@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-17 14:22:46 +02:00
..
6fire ALSA: 6fire: fix control and bulk message timeouts 2021-11-18 19:15:54 +01:00
bcd2000 ALSA: bcd2000: Fix a UAF bug on the error path of probing 2022-08-17 14:22:46 +02:00
caiaq module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
hiface module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
line6 ALSA: line6: fix control and interrupt message timeouts 2021-11-18 19:15:54 +01:00
misc ALSA: ua101: fix division by zero at probe 2021-11-18 19:15:54 +01:00
usx2y ALSA: usx2y: fix spelling mistakes 2021-07-05 19:30:33 +02:00
card.c ALSA: usb-audio: Unify mixer resume and reset_resume procedure 2021-09-13 15:00:31 +02:00
card.h ALSA: usb-audio: Improved lowlatency playback support 2021-12-08 09:04:36 +01:00
clock.c ALSA: usb-audio: Optimize TEAC clock quirk 2022-06-06 08:43:42 +02:00
clock.h ALSA: usb-audio: Constify audioformat pointer references 2020-11-23 15:15:36 +01:00
endpoint.c ALSA: usb-audio: Fix packet size calculation regression 2021-12-08 09:04:37 +01:00
endpoint.h ALSA: usb-audio: Avoid killing in-flight URBs during draining 2021-12-08 09:04:37 +01:00
format.c ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID 2022-01-27 11:04:08 +01:00
format.h
helper.c ALSA: usb-audio: Add snd_usb_get_host_interface() helper 2020-11-23 15:13:47 +01:00
helper.h ALSA: usb-audio: Add snd_usb_get_host_interface() helper 2020-11-23 15:13:47 +01:00
implicit.c ALSA: usb-audio: Move generic implicit fb quirk entries into quirks.c 2022-06-09 10:22:41 +02:00
implicit.h ALSA: usb-audio: Factor out the implicit feedback quirk code 2020-11-23 15:17:00 +01:00
Kconfig sound: Fix Kconfig indentation 2019-10-07 03:53:03 +02:00
Makefile ALSA: usb-audio: Factor out the implicit feedback quirk code 2020-11-23 15:17:00 +01:00
media.c ALSA: usb-audio: fix spelling mistakes 2021-07-05 19:33:54 +02:00
media.h media: sound/usb: Use Media Controller API to share media resources 2019-04-22 11:21:06 -04:00
midi.c ALSA: usb-audio: Cancel pending work at closing a MIDI substream 2022-06-09 10:22:27 +02:00
midi.h ALSA: usb-audio: generate midi streaming substream names from jack names 2021-03-01 09:21:54 +01:00
mixer.c ALSA: usb-audio: initialize variables that could ignore errors 2022-02-08 18:34:07 +01:00
mixer.h ALSA: usb-audio: Unify mixer resume and reset_resume procedure 2021-09-13 15:00:31 +02:00
mixer_maps.c ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX. 2022-07-12 16:35:04 +02:00
mixer_quirks.c ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB 2022-03-28 09:58:44 +02:00
mixer_quirks.h
mixer_s1810c.c ALSA: usb-audio: fix spelling mistakes 2021-07-05 19:33:54 +02:00
mixer_s1810c.h ALSA: usb-audio: Add support for Presonus Studio 1810c 2020-02-15 09:46:16 +01:00
mixer_scarlett.c ALSA: usb-audio: fix spelling mistakes 2021-07-05 19:33:54 +02:00
mixer_scarlett.h
mixer_scarlett_gen2.c ALSA: usb-audio: Fix a missing error check in scarlett gen2 mixer 2021-09-30 13:48:51 +02:00
mixer_scarlett_gen2.h ALSA: usb-audio: scarlett2: Improve driver startup messages 2021-05-21 16:22:52 +02:00
mixer_us16x08.c ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
mixer_us16x08.h ALSA: usb: Constify snd_kcontrol_new items 2020-01-03 09:24:34 +01:00
pcm.c ALSA: usb-audio: Set up (implicit) sync for Saffire 6 2022-06-14 18:36:25 +02:00
pcm.h ALSA: usb-audio: Make snd_usb_pcm_delay() static 2021-06-02 09:01:17 +02:00
power.c ALSA: usb-audio: More validations of descriptor units 2019-08-22 10:35:59 +02:00
power.h
proc.c ALSA: usb-audio: Show sync endpoint information in proc outputs 2020-11-23 15:16:45 +01:00
proc.h
quirks-table.h ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0) 2022-07-21 21:24:41 +02:00
quirks.c ALSA: usb-audio: Add quirk for Behringer UMC202HD 2022-08-17 14:22:45 +02:00
quirks.h ALSA: usb-audio: Move interface setup delay into quirk_flags 2021-08-02 09:06:02 +02:00
stream.c ALSA: usb-audio: Move tx_length quirk handling to quirk_flags 2021-08-02 09:05:57 +02:00
stream.h
usbaudio.h ALSA: usb-audio: Add quirk bits for enabling/disabling generic implicit fb 2022-06-09 10:22:41 +02:00
validate.c ALSA: usb-audio: Fix endianess in descriptor validation 2020-02-01 09:06:11 +01:00