ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
commit 5f8cf712582617d523120df67d392059eaf2fc4b upstream.
If a USB sound card reports 0 interfaces, an error condition is triggered
and the function usb_audio_probe errors out. In the error path, there was a
use-after-free vulnerability where the memory object of the card was first
freed, followed by a decrement of the number of active chips. Moving the
decrement above the atomic_dec fixes the UAF.
[ The original problem was introduced in 3.1 kernel, while it was
developed in a different form. The Fixes tag below indicates the
original commit but it doesn't mean that the patch is applicable
cleanly. -- tiwai ]
Fixes: 362e4e49ab
("ALSA: usb-audio - clear chip->probing on error exit")
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[surenb@google.com: resolve 3.18 differences]
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I54aecb9fe09beb178bc5d48f18ffa9ca13cf26e0
CVE-2018-19824
This commit is contained in:
parent
676c759154
commit
a4ffe3a96b
|
@ -607,9 +607,12 @@ snd_usb_audio_probe(struct usb_device *dev,
|
|||
|
||||
__error:
|
||||
if (chip) {
|
||||
/* chip->probing is inside the chip->card object,
|
||||
* reset before memory is possibly returned.
|
||||
*/
|
||||
chip->probing = 0;
|
||||
if (!chip->num_interfaces)
|
||||
snd_card_free(chip->card);
|
||||
chip->probing = 0;
|
||||
}
|
||||
mutex_unlock(®ister_mutex);
|
||||
__err_val:
|
||||
|
|
Loading…
Reference in New Issue