kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/sound/soc
History
Arseniy Krasnov e1a199ec31 ASoC: meson: axg-card: fix 'use-after-free' 
commit 4f9a714359 upstream.

Buffer 'card->dai_link' is reallocated in 'meson_card_reallocate_links()',
so move 'pad' pointer initialization after this function when memory is
already reallocated.

Kasan bug report:

==================================================================
BUG: KASAN: slab-use-after-free in axg_card_add_link+0x76c/0x9bc
Read of size 8 at addr ffff000000e8b260 by task modprobe/356

CPU: 0 PID: 356 Comm: modprobe Tainted: G O 6.9.12-sdkernel #1
Call trace:
 dump_backtrace+0x94/0xec
 show_stack+0x18/0x24
 dump_stack_lvl+0x78/0x90
 print_report+0xfc/0x5c0
 kasan_report+0xb8/0xfc
 __asan_load8+0x9c/0xb8
 axg_card_add_link+0x76c/0x9bc [snd_soc_meson_axg_sound_card]
 meson_card_probe+0x344/0x3b8 [snd_soc_meson_card_utils]
 platform_probe+0x8c/0xf4
 really_probe+0x110/0x39c
 __driver_probe_device+0xb8/0x18c
 driver_probe_device+0x108/0x1d8
 __driver_attach+0xd0/0x25c
 bus_for_each_dev+0xe0/0x154
 driver_attach+0x34/0x44
 bus_add_driver+0x134/0x294
 driver_register+0xa8/0x1e8
 __platform_driver_register+0x44/0x54
 axg_card_pdrv_init+0x20/0x1000 [snd_soc_meson_axg_sound_card]
 do_one_initcall+0xdc/0x25c
 do_init_module+0x10c/0x334
 load_module+0x24c4/0x26cc
 init_module_from_file+0xd4/0x128
 __arm64_sys_finit_module+0x1f4/0x41c
 invoke_syscall+0x60/0x188
 el0_svc_common.constprop.0+0x78/0x13c
 do_el0_svc+0x30/0x40
 el0_svc+0x38/0x78
 el0t_64_sync_handler+0x100/0x12c
 el0t_64_sync+0x190/0x194

Fixes: 7864a79f37 ("ASoC: meson: add axg sound card support")
Cc: Stable@vger.kernel.org
Signed-off-by: Arseniy Krasnov <avkrasnov@salutedevices.com>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://patch.msgid.link/20240911142425.598631-1-avkrasnov@salutedevices.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-09-18 19:23:06 +02:00
..
adi ASoC: adi: Migrate to new style legacy DAI naming flag 2022-06-27 13:16:34 +01:00
amd ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 2024-09-08 07:53:00 +02:00
apple ASoC: apple: mca: Improve handling of unavailable DMA channels 2023-03-11 13:55:31 +01:00
atmel ASoC: atmel: Fix the 8K sample parameter in I2SC master 2023-09-13 09:42:22 +02:00
au1x ASoC: au1x: Migrate to new style legacy DAI naming flag 2022-06-27 13:16:39 +01:00
bcm ASoC: bcm2835-i2s: Switch to use dev_err_probe() helper 2022-09-14 15:06:00 +01:00
cirrus ASoC: ep93xx: Migrate to new style legacy DAI naming flag 2022-06-27 13:16:20 +01:00
codecs ASoC: codecs: wsa883x: Correct Soundwire ports mask 2024-08-14 13:52:53 +02:00
dwc ASoC: dwc: move DMA init to snd_soc_dai_driver probe() 2023-06-21 16:00:53 +02:00
fsl ASoC: fsl-asoc-card: set priv->pdev before using it 2024-07-05 09:31:45 +02:00
generic ASoC: simple-card: fixup asoc_simple_probe() error handling 2023-11-08 14:10:57 +01:00
hisilicon ASoC: hisilicon: Migrate to new style legacy DAI naming flag 2022-06-27 13:16:24 +01:00
img ASoC: Refactor non_legacy_dai_naming flag 2022-06-29 16:58:08 +01:00
intel ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable 2024-08-03 08:49:52 +02:00
jz4740 ASoC: jz4740-i2s: Handle independent FIFO flush bits 2023-01-07 11:11:51 +01:00
kirkwood ASoC: kirkwood: Fix potential NULL dereference 2024-06-12 11:03:22 +02:00
mediatek ASoC: mediatek: mt8192: fix register configuration for tdm 2024-06-12 11:03:49 +02:00
meson ASoC: meson: axg-card: fix 'use-after-free' 2024-09-18 19:23:06 +02:00
mxs ASoC: mxs-saif: Migrate to new style legacy DAI naming flag 2022-06-27 13:16:43 +01:00
pxa ASoC: pxa: fix a memory leak in probe() 2023-10-25 12:03:15 +02:00
qcom ASoC: qcom: Adjust issues in case of DT error in asoc_qcom_lpass_cpu_platform_probe() 2024-08-03 08:49:20 +02:00
rockchip ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right mclk 2024-07-05 09:31:44 +02:00
samsung ASoC: soc.h: remove num_cpus/codecs 2022-09-20 12:19:30 +01:00
sh ASoC: Use of_property_read_bool() for boolean properties 2023-10-19 23:08:51 +02:00
sof ASoc: SOF: topology: Clear SOF link platform name upon unload 2024-09-12 11:10:29 +02:00
spear ASoC: spear: Migrate to new style legacy DAI naming flag 2022-06-27 13:16:18 +01:00
sprd ASoC: sprd: Use managed buffer allocation 2021-08-04 08:10:27 +02:00
sti ASoC: sti-uniperf: Migrate to new style legacy DAI naming flag 2022-06-27 13:16:29 +01:00
stm ASoC: stm32: i2s: remove irqf_oneshot flag 2022-11-10 17:50:52 +00:00
sunxi ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode 2024-09-12 11:10:29 +02:00
tegra ASoC: tegra: Fix CBB error during probe() 2024-09-12 11:10:28 +02:00
ti ASoC: ti: omap-hdmi: Fix too long driver name 2024-07-25 09:49:14 +02:00
uniphier ASoC: uniphier: Remove now redundant non_legacy_dai_naming flag 2022-06-27 13:16:55 +01:00
ux500 ASoC: ux500: Migrate to new style legacy DAI naming flag 2022-06-27 13:16:41 +01:00
xilinx ASoC: xilinx: Suppress second error message about reset failure in .remove() 2022-07-05 16:44:31 +01:00
xtensa ASoC: xtensa: Migrate to new style legacy DAI naming flag 2022-06-27 13:16:33 +01:00
Kconfig ASoC: apple: mca: Start new platform driver 2022-08-25 13:51:34 +01:00
Makefile ASoC: apple: mca: Start new platform driver 2022-08-25 13:51:34 +01:00
soc-ac97.c ASoC: Variable type completion 2022-08-17 13:00:27 +01:00
soc-acpi.c ALSA: Replace acpi_bus_get_device() 2022-02-01 08:08:08 +01:00
soc-card.c ASoC: Introduce 'fixup_controls' card method 2022-06-10 13:32:20 +01:00
soc-component.c Revert "ASoC: soc-component: using pm_runtime_resume_and_get instead of pm_runtime_get_sync" 2022-10-04 14:09:30 +01:00
soc-compress.c ASoC: soc-compress: Inherit atomicity from DAI link for Compress FE 2023-05-11 23:03:28 +09:00
soc-core.c ASoC: soc-core.c: Skip dummy codec when adding platforms 2024-04-13 13:05:19 +02:00
soc-dai.c ASoC: Change handling of unimplemented set_bclk_ratio 2022-08-19 13:19:59 +01:00
soc-dapm.c ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object 2024-09-12 11:10:16 +02:00
soc-devres.c ASoC: core: Remove only the registered component in devm functions 2020-07-07 11:55:46 +01:00
soc-generic-dmaengine-pcm.c ALSA: dmaengine: Synchronize dma channel after drop() 2024-07-25 09:49:14 +02:00
soc-jack.c ASoC: soc-card: Create jack kcontrol without pins 2022-04-14 17:37:21 +01:00
soc-link.c ASoC: soc-pcm: care trigger rollback 2020-12-09 12:13:38 +00:00
soc-ops.c ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw 2024-04-10 16:28:31 +02:00
soc-pcm.c ASoC: soc-pcm: test if a BE can be prepared 2023-06-21 16:00:53 +02:00
soc-topology-test.c ASoC: topology: KUnit: Remove now redundant non_legacy_dai_naming flag 2022-06-27 13:16:54 +01:00
soc-topology.c ASoC: topology: Properly initialize soc_enum values 2024-09-12 11:10:22 +02:00
soc-utils-test.c ASoC: soc-utils-test: Add test for snd_soc_params_to_bclk() 2022-08-17 15:19:14 +01:00
soc-utils.c ASoC: soc-utils: Export snd_soc_dai_is_dummy() symbol 2023-10-10 22:00:34 +02:00