Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1367605
| From | Takashi Iwai <tiwai@suse.de> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() |
| Date | 2016-03-30 22:40 +0200 |
| Message-ID | <riv4e-2lN-17@gated-at.bofh.it> (permalink) |
| References | <ritF8-1tZ-5@gated-at.bofh.it> <ritF8-1tZ-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Wed, 30 Mar 2016 21:03:22 +0200,
Vladis Dronov wrote:
>
> There is a double-free bug in [snd-usb-audio] module due to alloc/free logic
> flaw in snd_usb_add_audio_stream() function. This leads to kernel structures
> corruption and panic. Fix the code flow and alloc/free logic so there is no
> double-free.
>
> The detailed analysis: https://bugzilla.redhat.com/show_bug.cgi?id=1283358
>
> Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
> Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Thanks for the report. But how about a simpler fix like below?
Takashi
---
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index fb62bce2435c..0e154ae7924e 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
usb_audio_err(chip, "cannot memdup\n");
return -ENOMEM;
}
+ INIT_LIST_HEAD(&fp->list);
if (fp->nr_rates > MAX_NR_RATES) {
kfree(fp);
return -EINVAL;
@@ -193,8 +194,11 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
return 0;
error:
- kfree(fp);
- kfree(rate_table);
+ /* linked fp will be removed in snd_usb_audio_pcm_free() */
+ if (list_empty(&fp->list)) {
+ kfree(fp);
+ kfree(rate_table);
+ }
return err;
}
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() Vladis Dronov <vdronov@redhat.com> - 2016-03-30 21:10 +0200
[PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() Vladis Dronov <vdronov@redhat.com> - 2016-03-30 21:10 +0200
Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() kbuild test robot <lkp@intel.com> - 2016-03-30 21:40 +0200
Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() Takashi Iwai <tiwai@suse.de> - 2016-03-30 22:40 +0200
Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() Takashi Iwai <tiwai@suse.de> - 2016-03-31 12:00 +0200
Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() Vladis Dronov <vdronov@redhat.com> - 2016-03-31 14:40 +0200
Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() Takashi Iwai <tiwai@suse.de> - 2016-03-31 15:00 +0200
Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() Vladis Dronov <vdronov@redhat.com> - 2016-03-31 16:10 +0200
Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() Takashi Iwai <tiwai@suse.de> - 2016-03-31 16:30 +0200
Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() Vladis Dronov <vdronov@redhat.com> - 2016-03-31 18:10 +0200
Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream() Takashi Iwai <tiwai@suse.de> - 2016-03-31 18:20 +0200
csiph-web