linux-kernel - Re: [PATCH v2] ALSA: hda: Fix missing pointer check in hda_component_manager

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87ldli9ch8.wl-tiwai@suse.de>
Date: Sat, 11 Oct 2025 08:30:43 +0200
From: Takashi Iwai <tiwai@...e.de>
To: Denis Arefev <arefev@...mel.ru>
Cc: David Rhodes <david.rhodes@...rus.com>,
	Richard Fitzgerald <rf@...nsource.cirrus.com>,
	Jaroslav Kysela <perex@...ex.cz>,
	Takashi Iwai <tiwai@...e.com>,
	linux-sound@...r.kernel.org,
	patches@...nsource.cirrus.com,
	linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org,
	stable@...r.kernel.org
Subject: Re: [PATCH v2] ALSA: hda: Fix missing pointer check in hda_component_manager_init function

On Thu, 09 Oct 2025 12:50:47 +0200,
Denis Arefev wrote:
> 
> The __component_match_add function may assign the 'matchptr' pointer
> the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced.
> 
> The call stack leading to the error looks like this:
> 
> hda_component_manager_init
> |-> component_match_add
>     |-> component_match_add_release
>         |-> __component_match_add ( ... ,**matchptr, ... )
>             |-> *matchptr = ERR_PTR(-ENOMEM);       // assign
> |-> component_master_add_with_match( ...  match)
>     |-> component_match_realloc(match, match->num); // dereference
> 
> Add IS_ERR() check to prevent the crash.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: ae7abe36e352 ("ALSA: hda/realtek: Add CS35L41 support for Thinkpad laptops")
> Cc: stable@...r.kernel.org
> Signed-off-by: Denis Arefev <arefev@...mel.ru>
> ---
> V1 -> V2:
> Changed tag Fixes
> Add print to log an error it as Stefan Binding <sbinding@...nsource.cirrus.com> suggested

Applied now.  Thanks.


Takashi