mirror of
https://github.com/torvalds/linux
synced 2024-10-09 21:05:10 +00:00
1c98f57440
Our code analyzer reported a uaf. In snd_emu8000_create_mixer, the callee snd_ctl_add(..,emu->controls[i]) calls snd_ctl_add_replace(.., kcontrol,..). Inside snd_ctl_add_replace(), if error happens, kcontrol will be freed by snd_ctl_free_one(kcontrol). Then emu->controls[i] points to a freed memory, and the execution comes to __error branch of snd_emu8000_create_mixer. The freed emu->controls[i] is used in snd_ctl_remove(card, emu->controls[i]). My patch set emu->controls[i] to NULL if snd_ctl_add() failed to avoid the uaf. Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20210426131129.4796-1-lyl2019@mail.ustc.edu.cn Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
---|---|---|
.. | ||
ac97 | ||
aoa | ||
arm | ||
atmel | ||
core | ||
drivers | ||
firewire | ||
hda | ||
i2c | ||
isa | ||
mips | ||
oss | ||
parisc | ||
pci | ||
pcmcia | ||
ppc | ||
sh | ||
soc | ||
sparc | ||
spi | ||
synth | ||
usb | ||
virtio | ||
x86 | ||
xen | ||
ac97_bus.c | ||
Kconfig | ||
last.c | ||
Makefile | ||
sound_core.c |