Hi-- On 7/14/22 18:54, Zheyu Ma wrote: > Hello, > > I found a bug in the driver cx88-alsa. > > When the driver fails in the function snd_cx88_create() at the probe > time, it will cause a UAF bug as follows: It's not a UAF. It's a WARN() macro with an IRQ management problem, as shown in the next 2 lines below: > > [ 24.343899] Trying to free already-free IRQ 0 > [ 24.344815] WARNING: CPU: 7 PID: 389 at kernel/irq/manage.c:1895 > free_irq+0x3a4/0x7c0 > [ 24.348448] RIP: 0010:free_irq+0x3a4/0x7c0 > [ 24.356716] Call Trace: > [ 24.357124] snd_cx88_dev_free+0x71/0x100 [cx88_alsa] > [ 24.358008] release_card_device+0x7d/0x190 > [ 24.358699] device_release+0x97/0x1c0 > [ 24.359022] kobject_put+0x144/0x1c0 > [ 24.359329] snd_card_free+0xec/0x150 > [ 24.360078] cx88_audio_initdev+0x8f4/0xce0 [cx88_alsa] > > Since I'm not familiar with the driver, could you please give me some > hints to fix it? > > regards, > > Zheyu Ma -- ~Randy
