Lv Yunlong 93588ea2fb ALSA: sb: Fix two use after free in snd_sb_qsound_build ... commit 4fb44dd2c1 upstream. In snd_sb_qsound_build, snd_ctl_add(..,p->qsound_switch...) and snd_ctl_add(..,p->qsound_space..) are called. But the second arguments of snd_ctl_add() could be freed via snd_ctl_add_replace() ->snd_ctl_free_one(). After the error code is returned, snd_sb_qsound_destroy(p) is called in __error branch. But in snd_sb_qsound_destroy(), the freed p->qsound_switch and p->qsound_space are still used by snd_ctl_remove(). My patch set p->qsound_switch and p->qsound_space to NULL if snd_ctl_add() failed to avoid the uaf bugs. But these codes need to further be improved with the code style. Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20210426145541.8070-1-lyl2019@mail.ustc.edu.cn Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-05-11 14:04:13 +02:00
..
ad1816a
ad1848
cs423x	ALSA: cs4236: fix error return comparison of an unsigned integer	2020-01-09 10:20:00 +01:00
es1688	ALSA: es1688: Add the missed snd_card_free()	2020-06-17 16:40:27 +02:00
galaxy
gus
msnd
opti9xx	ALSA: opti9xx: shut up gcc-10 range warning	2020-05-06 08:15:15 +02:00
sb	ALSA: sb: Fix two use after free in snd_sb_qsound_build	2021-05-11 14:04:13 +02:00
wavefront	ALSA: isa/wavefront: prevent out of bounds write in ioctl	2020-06-24 17:50:11 +02:00
wss
adlib.c
als100.c
azt2320.c
cmi8328.c
cmi8330.c
es18xx.c
Kconfig
Makefile
opl3sa2.c
sc6000.c
sscape.c