linux-kernel - [BUG] media: cx88-alsa: Found a bug at the probe time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMhUBj=bs8rbiPGX1qOv9FSU8m=TdRZqqJGvRcynKbaWwf_A-A@mail.gmail.com>
Date:   Fri, 15 Jul 2022 09:54:28 +0800
From:   Zheyu Ma <zheyuma97@...il.com>
To:     Mauro Carvalho Chehab <mchehab@...nel.org>
Cc:     linux-media <linux-media@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: [BUG] media: cx88-alsa: Found a bug at the probe time

Hello,

I found a bug in the driver cx88-alsa.

When the driver fails in the function snd_cx88_create() at the probe
time, it will cause a UAF bug as follows:

[   24.343899] Trying to free already-free IRQ 0
[   24.344815] WARNING: CPU: 7 PID: 389 at kernel/irq/manage.c:1895
free_irq+0x3a4/0x7c0
[   24.348448] RIP: 0010:free_irq+0x3a4/0x7c0
[   24.356716] Call Trace:
[   24.357124]  snd_cx88_dev_free+0x71/0x100 [cx88_alsa]
[   24.358008]  release_card_device+0x7d/0x190
[   24.358699]  device_release+0x97/0x1c0
[   24.359022]  kobject_put+0x144/0x1c0
[   24.359329]  snd_card_free+0xec/0x150
[   24.360078]  cx88_audio_initdev+0x8f4/0xce0 [cx88_alsa]

Since I'm not familiar with the driver, could you please give me some
hints to fix it?

regards,

Zheyu Ma