This is a note to let you know that I've just added the patch titled
ALSA: ymfpci: Fix the missing snd_card_free() call at probe error
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
alsa-ymfpci-fix-the-missing-snd_card_free-call-at-probe-error.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 1d0eb6143c1e85d3f9a3f5a616ee7e5dc351d33b Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@xxxxxxx>
Date: Wed, 23 Aug 2023 18:16:25 +0200
Subject: ALSA: ymfpci: Fix the missing snd_card_free() call at probe error
From: Takashi Iwai <tiwai@xxxxxxx>
commit 1d0eb6143c1e85d3f9a3f5a616ee7e5dc351d33b upstream.
Like a few other drivers, YMFPCI driver needs to clean up with
snd_card_free() call at an error path of the probe; otherwise the
other devres resources are released before the card and it results in
the UAF.
This patch uses the helper for handling the probe error gracefully.
Fixes: f33fc1576757 ("ALSA: ymfpci: Create card with device-managed snd_devm_card_new()")
Cc: <stable@xxxxxxxxxxxxxxx>
Reported-and-tested-by: Takashi Yano <takashi.yano@xxxxxxxxxxx>
Closes: https://lore.kernel.org/r/20230823135846.1812-1-takashi.yano@xxxxxxxxxxx
Link: https://lore.kernel.org/r/20230823161625.5807-1-tiwai@xxxxxxx
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
sound/pci/ymfpci/ymfpci.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/sound/pci/ymfpci/ymfpci.c
+++ b/sound/pci/ymfpci/ymfpci.c
@@ -150,8 +150,8 @@ static inline int snd_ymfpci_create_game
void snd_ymfpci_free_gameport(struct snd_ymfpci *chip) { }
#endif /* SUPPORT_JOYSTICK */
-static int snd_card_ymfpci_probe(struct pci_dev *pci,
- const struct pci_device_id *pci_id)
+static int __snd_card_ymfpci_probe(struct pci_dev *pci,
+ const struct pci_device_id *pci_id)
{
static int dev;
struct snd_card *card;
@@ -333,6 +333,12 @@ static int snd_card_ymfpci_probe(struct
return 0;
}
+static int snd_card_ymfpci_probe(struct pci_dev *pci,
+ const struct pci_device_id *pci_id)
+{
+ return snd_card_free_on_error(&pci->dev, __snd_card_ymfpci_probe(pci, pci_id));
+}
+
static struct pci_driver ymfpci_driver = {
.name = KBUILD_MODNAME,
.id_table = snd_ymfpci_ids,
Patches currently in stable-queue which might be from tiwai@xxxxxxx are
queue-5.15/alsa-pcm-fix-potential-data-race-at-pcm-memory-alloc.patch
queue-5.15/alsa-ymfpci-fix-the-missing-snd_card_free-call-at-probe-error.patch
