On Wed, 30 Mar 2016 22:31:15 +0200, Takashi Iwai wrote: > > On Wed, 30 Mar 2016 21:03:22 +0200, > Vladis Dronov wrote: > > > > There is a double-free bug in [snd-usb-audio] module due to alloc/free logic > > flaw in snd_usb_add_audio_stream() function. This leads to kernel structures > > corruption and panic. Fix the code flow and alloc/free logic so there is no > > double-free. > > > > The detailed analysis: https://bugzilla.redhat.com/show_bug.cgi?id=1283358 > > > > Reported-by: Ralf Spenneberg <ralf@xxxxxxxxxxxxxx> > > Signed-off-by: Vladis Dronov <vdronov@xxxxxxxxxx> > > Thanks for the report. But how about a simpler fix like below? Maybe the one below is more straightforward (and even simpler). Let me know if this works enough for you. thanks, Takashi -- 8< -- From: Takashi Iwai <tiwai@xxxxxxx> Subject: [PATCH] ALSA: usb-audio: Fix double free in create_fixed_stream_quirk() error paths create_fixed_stream_quirk() function allocates the audioformat object by itself and frees it upon error before returning. However, once when the object is linked to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be double-freed, eventually resulting in a memory corruption. This patch fixes this failure in the error path by unlinking the audioformat object before freeing it. [Note for stable backports: this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()')] Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358 Reported-by: Ralf Spenneberg <ralf@xxxxxxxxxxxxxx> Reported-by: Vladis Dronov <vdronov@xxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> # see the note above Signed-off-by: Takashi Iwai <tiwai@xxxxxxx> --- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index fb62bce2435c..a5a9ecaafb37 100644 --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, usb_audio_err(chip, "cannot memdup\n"); return -ENOMEM; } + INIT_LIST_HEAD(&fp->list); if (fp->nr_rates > MAX_NR_RATES) { kfree(fp); return -EINVAL; @@ -193,6 +194,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, return 0; error: + list_del(&fp->list); /* unlink for avoiding double-free */ kfree(fp); kfree(rate_table); return err; -- 2.7.4 _______________________________________________ Alsa-devel mailing list Alsa-devel@xxxxxxxxxxxxxxxx http://mailman.alsa-project.org/mailman/listinfo/alsa-devel
