From bd119c2d2fa21ab859270f0fecd25b73ce7e4645 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 8 May 2021 13:34:41 +0200 Subject: [PATCH] 4.9-stable patches added patches: alsa-emu8000-fix-a-use-after-free-in-snd_emu8000_create_mixer.patch alsa-sb-fix-two-use-after-free-in-snd_sb_qsound_build.patch --- ...ter-free-in-snd_emu8000_create_mixer.patch | 44 ++++++++++++++++ ...se-after-free-in-snd_sb_qsound_build.patch | 50 +++++++++++++++++++ queue-4.9/series | 2 + 3 files changed, 96 insertions(+) create mode 100644 queue-4.9/alsa-emu8000-fix-a-use-after-free-in-snd_emu8000_create_mixer.patch create mode 100644 queue-4.9/alsa-sb-fix-two-use-after-free-in-snd_sb_qsound_build.patch diff --git a/queue-4.9/alsa-emu8000-fix-a-use-after-free-in-snd_emu8000_create_mixer.patch b/queue-4.9/alsa-emu8000-fix-a-use-after-free-in-snd_emu8000_create_mixer.patch new file mode 100644 index 00000000000..c455f2d5044 --- /dev/null +++ b/queue-4.9/alsa-emu8000-fix-a-use-after-free-in-snd_emu8000_create_mixer.patch @@ -0,0 +1,44 @@ +From 1c98f574403dbcf2eb832d5535a10d967333ef2d Mon Sep 17 00:00:00 2001 +From: Lv Yunlong +Date: Mon, 26 Apr 2021 06:11:29 -0700 +Subject: ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer + +From: Lv Yunlong + +commit 1c98f574403dbcf2eb832d5535a10d967333ef2d upstream. + +Our code analyzer reported a uaf. + +In snd_emu8000_create_mixer, the callee snd_ctl_add(..,emu->controls[i]) +calls snd_ctl_add_replace(.., kcontrol,..). Inside snd_ctl_add_replace(), +if error happens, kcontrol will be freed by snd_ctl_free_one(kcontrol). +Then emu->controls[i] points to a freed memory, and the execution comes +to __error branch of snd_emu8000_create_mixer. The freed emu->controls[i] +is used in snd_ctl_remove(card, emu->controls[i]). + +My patch set emu->controls[i] to NULL if snd_ctl_add() failed to avoid +the uaf. + +Signed-off-by: Lv Yunlong +Cc: +Link: https://lore.kernel.org/r/20210426131129.4796-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/isa/sb/emu8000.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/isa/sb/emu8000.c ++++ b/sound/isa/sb/emu8000.c +@@ -1042,8 +1042,10 @@ snd_emu8000_create_mixer(struct snd_card + + memset(emu->controls, 0, sizeof(emu->controls)); + for (i = 0; i < EMU8000_NUM_CONTROLS; i++) { +- if ((err = snd_ctl_add(card, emu->controls[i] = snd_ctl_new1(mixer_defs[i], emu))) < 0) ++ if ((err = snd_ctl_add(card, emu->controls[i] = snd_ctl_new1(mixer_defs[i], emu))) < 0) { ++ emu->controls[i] = NULL; + goto __error; ++ } + } + return 0; + diff --git a/queue-4.9/alsa-sb-fix-two-use-after-free-in-snd_sb_qsound_build.patch b/queue-4.9/alsa-sb-fix-two-use-after-free-in-snd_sb_qsound_build.patch new file mode 100644 index 00000000000..20bae7b941a --- /dev/null +++ b/queue-4.9/alsa-sb-fix-two-use-after-free-in-snd_sb_qsound_build.patch @@ -0,0 +1,50 @@ +From 4fb44dd2c1dda18606348acdfdb97e8759dde9df Mon Sep 17 00:00:00 2001 +From: Lv Yunlong +Date: Mon, 26 Apr 2021 07:55:41 -0700 +Subject: ALSA: sb: Fix two use after free in snd_sb_qsound_build + +From: Lv Yunlong + +commit 4fb44dd2c1dda18606348acdfdb97e8759dde9df upstream. + +In snd_sb_qsound_build, snd_ctl_add(..,p->qsound_switch...) and +snd_ctl_add(..,p->qsound_space..) are called. But the second +arguments of snd_ctl_add() could be freed via snd_ctl_add_replace() +->snd_ctl_free_one(). After the error code is returned, +snd_sb_qsound_destroy(p) is called in __error branch. + +But in snd_sb_qsound_destroy(), the freed p->qsound_switch and +p->qsound_space are still used by snd_ctl_remove(). + +My patch set p->qsound_switch and p->qsound_space to NULL if +snd_ctl_add() failed to avoid the uaf bugs. But these codes need +to further be improved with the code style. + +Signed-off-by: Lv Yunlong +Cc: +Link: https://lore.kernel.org/r/20210426145541.8070-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/isa/sb/sb16_csp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/sound/isa/sb/sb16_csp.c ++++ b/sound/isa/sb/sb16_csp.c +@@ -1059,10 +1059,14 @@ static int snd_sb_qsound_build(struct sn + + spin_lock_init(&p->q_lock); + +- if ((err = snd_ctl_add(card, p->qsound_switch = snd_ctl_new1(&snd_sb_qsound_switch, p))) < 0) ++ if ((err = snd_ctl_add(card, p->qsound_switch = snd_ctl_new1(&snd_sb_qsound_switch, p))) < 0) { ++ p->qsound_switch = NULL; + goto __error; +- if ((err = snd_ctl_add(card, p->qsound_space = snd_ctl_new1(&snd_sb_qsound_space, p))) < 0) ++ } ++ if ((err = snd_ctl_add(card, p->qsound_space = snd_ctl_new1(&snd_sb_qsound_space, p))) < 0) { ++ p->qsound_space = NULL; + goto __error; ++ } + + return 0; + diff --git a/queue-4.9/series b/queue-4.9/series index 6b39019b60c..7b86a3f677f 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -45,3 +45,5 @@ drm-msm-mdp5-configure-pp_sync_height-to-double-the-.patch drm-amdgpu-fix-null-pointer-dereference.patch scsi-lpfc-fix-crash-when-a-reg_rpi-mailbox-fails-tri.patch scsi-libfc-fix-a-format-specifier.patch +alsa-emu8000-fix-a-use-after-free-in-snd_emu8000_create_mixer.patch +alsa-sb-fix-two-use-after-free-in-snd_sb_qsound_build.patch -- 2.47.3