[PATCH 1/2] ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object

[Sameer Pujar <spujar@xxxxxxxxxx>]

From: robelin <robelin@xxxxxxxxxx>

When using kernel with the following extra config,

  - CONFIG_KASAN=y
  - CONFIG_KASAN_GENERIC=y
  - CONFIG_KASAN_INLINE=y
  - CONFIG_KASAN_VMALLOC=y
  - CONFIG_FRAME_WARN=4096

kernel detects that snd_pcm_suspend_all() access a freed
'snd_soc_pcm_runtime' object when the system is suspended, which
leads to a use-after-free bug:

[   52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270
[   52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330
[   52.047771]
[   52.047776] CPU: 7 PID: 2330 Comm: systemd-sleep Tainted: G           O      5.15.148-tegra #9
[   52.047781] Hardware name: NVIDIA NVIDIA Jetson AGX Orin Developer Kit/Jetson, BIOS 36.4.0-gcid-36705213 07/01/2024
[   52.047785] Call trace:
[   52.047787]  dump_backtrace+0x0/0x3c0
[   52.047794]  show_stack+0x34/0x50
[   52.047797]  dump_stack_lvl+0x68/0x8c
[   52.047802]  print_address_description.constprop.0+0x74/0x2c0
[   52.047809]  kasan_report+0x210/0x230
[   52.047815]  __asan_report_load1_noabort+0x3c/0x50
[   52.047820]  snd_pcm_suspend_all+0x1a8/0x270
[   52.047824]  snd_soc_suspend+0x19c/0x4e0
[   52.047831]  dpm_prepare+0x1c0/0xb90
[   52.047838]  dpm_suspend_start+0x30/0xe0
[   52.047842]  suspend_devices_and_enter+0x220/0xfd0
[   52.047849]  pm_suspend+0x464/0x560
[   52.047853]  state_store+0xac/0x180
[   52.047856]  kobj_attr_store+0x3c/0x90
[   52.047861]  sysfs_kf_write+0x10c/0x180
[   52.047868]  kernfs_fop_write_iter+0x280/0x3e0
[   52.047873]  new_sync_write+0x2cc/0x4c0
[   52.047877]  vfs_write+0x514/0x760
[   52.047880]  ksys_write+0x100/0x1f0
[   52.047883]  __arm64_sys_write+0x78/0xc0
[   52.047887]  invoke_syscall+0x7c/0x280
[   52.047892]  el0_svc_common.constprop.0+0xcc/0x270
[   52.047897]  do_el0_svc+0xb0/0x100
[   52.047901]  el0_svc+0x3c/0x90
[   52.047905]  el0t_64_sync_handler+0xac/0x130
[   52.047908]  el0t_64_sync+0x1a4/0x1a8

The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before
making any access. So we need to always set 'substream->runtime' to NULL
everytime we kfree() it.

Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables")
Signed-off-by: robelin <robelin@xxxxxxxxxx>
Signed-off-by: Sameer Pujar <spujar@xxxxxxxxxx>
---
 sound/soc/soc-dapm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index d7d6dbb9d9ea..e5900cb65cf6 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -4056,6 +4056,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
 
 	case SND_SOC_DAPM_POST_PMD:
 		kfree(substream->runtime);
+		substream->runtime = NULL;
 		break;
 
 	default:
-- 
2.17.1