kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/sound/usb
History
Jeongjun Park 647d6b8d22 ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free 
commit 9f2c0ac142 upstream.

The previous commit 0718a78f6a ("ALSA: usb-audio: Kill timer properly at
removal") patched a UAF issue caused by the error timer.

However, because the error timer kill added in this patch occurs after the
endpoint delete, a race condition to UAF still occurs, albeit rarely.

Additionally, since kill-cleanup for urb is also missing, freed memory can
be accessed in interrupt context related to urb, which can cause UAF.

Therefore, to prevent this, error timer and urb must be killed before
freeing the heap memory.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+f02665daa2abeef4a947@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f02665daa2abeef4a947
Fixes: 0718a78f6a ("ALSA: usb-audio: Kill timer properly at removal")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-12 12:57:18 +02:00
..
6fire ALSA: 6fire: Release resources at card release 2024-12-05 14:01:58 +01:00
bcd2000 ALSA: bcd2000: refactor deprecated strncpy 2023-07-29 13:53:56 +02:00
caiaq ALSA: caiaq: Use snd_card_free_when_closed() at disconnection 2024-12-05 14:01:58 +01:00
hiface ALSA: usb: Use *-y instead of *-objs in Makefile 2024-05-08 18:17:53 +02:00
line6 ALSA: line6: update contact information 2024-10-10 14:02:57 +02:00
misc ALSA: usb: Use *-y instead of *-objs in Makefile 2024-05-08 18:17:53 +02:00
usx2y ALSA: usx2y: validate nrpacks module parameter on probe 2025-03-13 13:02:05 +01:00
card.c ALSA: usb-audio: Add logitech Audio profile quirk 2024-09-12 18:01:25 +02:00
card.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2022-12-22 09:13:54 +01:00
clock.c ALSA: usb-audio: Fix out of bounds reads when finding clock sources 2024-12-05 14:02:41 +01:00
clock.h ALSA: usb-audio: Constify audioformat pointer references 2020-11-23 15:15:36 +01:00
endpoint.c ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() 2025-05-09 09:50:29 +02:00
endpoint.h ALSA: usb-audio: Remove unused function declaration 2023-08-01 16:56:57 +02:00
format.c ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset 2025-05-09 09:50:29 +02:00
format.h ALSA: usb: initial USB Audio Device Class 3.0 support 2018-03-21 11:46:33 +01:00
helper.c ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
helper.h ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
implicit.c ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 2025-06-19 15:32:34 +02:00
implicit.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2022-12-22 09:13:54 +01:00
Kconfig ALSA: usb-audio: USB MIDI 2.0 UMP support 2023-05-23 12:11:02 +02:00
Makefile ALSA: usb: Use *-y instead of *-objs in Makefile 2024-05-08 18:17:53 +02:00
media.c ALSA: pcm: Don't embed device 2023-08-17 09:23:45 +02:00
media.h media: sound/usb: Use Media Controller API to share media resources 2019-04-22 11:21:06 -04:00
midi.c ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free 2025-10-12 12:57:18 +02:00
midi.h ALSA: usb-audio: Manage number of rawmidis globally 2023-05-23 12:11:00 +02:00
midi2.c ALSA: usb-audio: Update UMP group attributes for GTB blocks, too 2024-08-07 11:31:38 +02:00
midi2.h ALSA: usb-audio: USB MIDI 2.0 UMP support 2023-05-23 12:11:02 +02:00
mixer.c ALSA: usb-audio: Make mic volume workarounds globally applicable 2024-12-14 20:03:54 +01:00
mixer.h ALSA: usb-audio: Add input value sanity checks for standard types 2024-08-06 18:27:08 +02:00
mixer_maps.c ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card 2025-06-27 11:11:39 +01:00
mixer_quirks.c ALSA: usb-audio: move mixer_quirks' min_mute into common quirk 2025-10-02 13:44:07 +02:00
mixer_quirks.h ALSA: usb-audio: Drop CONFIG_PM ifdefs 2021-12-06 10:19:40 +01:00
mixer_s1810c.c ALSA: usb-audio: remove redundant assignment to variable c 2022-02-08 08:21:32 +01:00
mixer_s1810c.h ALSA: usb-audio: Add support for Presonus Studio 1810c 2020-02-15 09:46:16 +01:00
mixer_scarlett.c ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
mixer_scarlett.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mixer_scarlett2.c ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() 2025-08-15 12:14:12 +02:00
mixer_scarlett2.h ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 2023-10-27 11:22:59 +02:00
mixer_us16x08.c ALSA: usb-audio: US16x08: Initialize array before use 2025-01-09 13:33:40 +01:00
mixer_us16x08.h ALSA: usb: Constify snd_kcontrol_new items 2020-01-03 09:24:34 +01:00
pcm.c ALSA: usb-audio: Fix broken resume due to UAC3 power state 2023-06-16 09:28:08 +02:00
pcm.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2022-12-22 09:13:54 +01:00
power.c ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
power.h ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
proc.c ALSA: usb-audio: Show sync endpoint information in proc outputs 2020-11-23 15:16:45 +01:00
proc.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
quirks-table.h ALSA: usb-audio: Add extra PID for RME Digiface USB 2024-12-14 20:03:23 +01:00
quirks.c ALSA: usb-audio: Add mute TLV for playback volumes on more devices 2025-10-02 13:44:07 +02:00
quirks.h ALSA: usb-audio: Register card at the last interface 2022-09-06 11:04:56 +02:00
stream.c ALSA: usb-audio: Fix size validation in convert_chmap_v3() 2025-08-28 16:31:13 +02:00
stream.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
usbaudio.h ALSA: usb-audio: move mixer_quirks' min_mute into common quirk 2025-10-02 13:44:07 +02:00
validate.c ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation 2025-08-28 16:31:16 +02:00