linux-sg2042/sound/isa
Lv Yunlong 4fb44dd2c1 ALSA: sb: Fix two use after free in snd_sb_qsound_build
In snd_sb_qsound_build, snd_ctl_add(..,p->qsound_switch...) and
snd_ctl_add(..,p->qsound_space..) are called. But the second
arguments of snd_ctl_add() could be freed via snd_ctl_add_replace()
->snd_ctl_free_one(). After the error code is returned,
snd_sb_qsound_destroy(p) is called in __error branch.

But in snd_sb_qsound_destroy(), the freed p->qsound_switch and
p->qsound_space are still used by snd_ctl_remove().

My patch set p->qsound_switch and p->qsound_space to NULL if
snd_ctl_add() failed to avoid the uaf bugs. But these codes need
to further be improved with the code style.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210426145541.8070-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-04-26 18:01:07 +02:00
..
ad1816a module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
ad1848 module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
cs423x module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
es1688 module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
galaxy isa: Make the remove callback for isa drivers return void 2021-01-26 07:42:27 +01:00
gus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
msnd isa: Make the remove callback for isa drivers return void 2021-01-26 07:42:27 +01:00
opti9xx module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
sb ALSA: sb: Fix two use after free in snd_sb_qsound_build 2021-04-26 18:01:07 +02:00
wavefront module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
wss ALSA: wss: More constifications 2020-01-05 16:15:05 +01:00
Kconfig sound: Fix Kconfig indentation 2019-10-07 03:53:03 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
adlib.c isa: Make the remove callback for isa drivers return void 2021-01-26 07:42:27 +01:00
als100.c module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
azt2320.c module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
cmi8328.c isa: Make the remove callback for isa drivers return void 2021-01-26 07:42:27 +01:00
cmi8330.c module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
es18xx.c module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
opl3sa2.c module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
sc6000.c module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
sscape.c isa: Make the remove callback for isa drivers return void 2021-01-26 07:42:27 +01:00