mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-20 09:31:09 +00:00
Code Issues Releases Wiki Activity
linux-stable/sound/isa/sb
History
Lv Yunlong cc427a507f ALSA: sb: Fix two use after free in snd_sb_qsound_build 
commit 4fb44dd2c1 upstream.

In snd_sb_qsound_build, snd_ctl_add(..,p->qsound_switch...) and
snd_ctl_add(..,p->qsound_space..) are called. But the second
arguments of snd_ctl_add() could be freed via snd_ctl_add_replace()
->snd_ctl_free_one(). After the error code is returned,
snd_sb_qsound_destroy(p) is called in __error branch.

But in snd_sb_qsound_destroy(), the freed p->qsound_switch and
p->qsound_space are still used by snd_ctl_remove().

My patch set p->qsound_switch and p->qsound_space to NULL if
snd_ctl_add() failed to avoid the uaf bugs. But these codes need
to further be improved with the code style.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210426145541.8070-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-11 14:47:32 +02:00
..
emu8000.c ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer 2021-05-11 14:47:32 +02:00
emu8000_callback.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
emu8000_local.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
emu8000_patch.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
emu8000_pcm.c ALSA: emu8000: Fix the cast to __user pointer 2020-02-10 08:26:38 +01:00
emu8000_synth.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jazz16.c ALSA: sb: More constifications 2020-01-05 16:15:00 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
sb8.c ALSA: sb: More constifications 2020-01-05 16:15:00 +01:00
sb8_main.c ALSA: Use fallthrough pseudo-keyword 2020-07-09 13:01:29 +02:00
sb8_midi.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
sb16.c ALSA: sb: More constifications 2020-01-05 16:15:00 +01:00
sb16_csp.c ALSA: sb: Fix two use after free in snd_sb_qsound_build 2021-05-11 14:47:32 +02:00
sb16_main.c ALSA: isa: Drop superfluous ioctl PCM ops 2019-12-11 07:25:28 +01:00
sb_common.c ALSA: isa: Constify snd_device_ops definitions 2020-01-03 09:23:54 +01:00
sb_mixer.c ALSA: sb: More constifications 2020-01-05 16:15:00 +01:00
sbawe.c