kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/sound/usb
History
Berk Cem Goksel e6f103a22b ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() 
commit 930e69757b upstream.

When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees
mixer->id_elems but the controls already added to the card still
reference the freed memory. Later when snd_card_register() runs,
the OSS mixer layer calls their callbacks and hits a use-after-free read.

Call trace:
  get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411
  get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241
  mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381
  snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887
  ...
  snd_card_register+0x4ed/0x6d0 sound/core/init.c:923
  usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025

Fix by calling snd_ctl_remove() for all mixer controls before freeing
id_elems. We save the next pointer first because snd_ctl_remove()
frees the current element.

Fixes: 6639b6c236 ("[ALSA] usb-audio - add mixer control notifications")
Cc: stable@vger.kernel.org
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Signed-off-by: Berk Cem Goksel <berkcgoksel@gmail.com>
Link: https://patch.msgid.link/20260120102855.7300-1-berkcgoksel@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-30 10:28:45 +01:00
..
6fire ALSA: 6fire: Release resources at card release 2024-12-05 14:01:58 +01:00
bcd2000 ALSA: bcd2000: refactor deprecated strncpy 2023-07-29 13:53:56 +02:00
caiaq ALSA: caiaq: Use snd_card_free_when_closed() at disconnection 2024-12-05 14:01:58 +01:00
hiface ALSA: usb: Use *-y instead of *-objs in Makefile 2024-05-08 18:17:53 +02:00
line6 ALSA: line6: update contact information 2024-10-10 14:02:57 +02:00
misc ALSA: usb: Use *-y instead of *-objs in Makefile 2024-05-08 18:17:53 +02:00
usx2y ALSA: usx2y: validate nrpacks module parameter on probe 2025-03-13 13:02:05 +01:00
card.c ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card 2025-10-23 16:20:37 +02:00
card.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2022-12-22 09:13:54 +01:00
clock.c ALSA: usb-audio: Fix out of bounds reads when finding clock sources 2024-12-05 14:02:41 +01:00
clock.h ALSA: usb-audio: Constify audioformat pointer references 2020-11-23 15:15:36 +01:00
endpoint.c ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check 2025-12-01 11:43:36 +01:00
endpoint.h ALSA: usb-audio: Remove unused function declaration 2023-08-01 16:56:57 +02:00
format.c ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset 2025-05-09 09:50:29 +02:00
format.h ALSA: usb: initial USB Audio Device Class 3.0 support 2018-03-21 11:46:33 +01:00
helper.c ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
helper.h ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
implicit.c ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 2025-06-19 15:32:34 +02:00
implicit.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2022-12-22 09:13:54 +01:00
Kconfig ALSA: usb-audio: USB MIDI 2.0 UMP support 2023-05-23 12:11:02 +02:00
Makefile ALSA: usb: Use *-y instead of *-objs in Makefile 2024-05-08 18:17:53 +02:00
media.c ALSA: pcm: Don't embed device 2023-08-17 09:23:45 +02:00
media.h media: sound/usb: Use Media Controller API to share media resources 2019-04-22 11:21:06 -04:00
midi.c ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free 2025-10-12 12:57:18 +02:00
midi.h ALSA: usb-audio: Manage number of rawmidis globally 2023-05-23 12:11:00 +02:00
midi2.c ALSA: usb-audio: Update UMP group attributes for GTB blocks, too 2024-08-07 11:31:38 +02:00
midi2.h ALSA: usb-audio: USB MIDI 2.0 UMP support 2023-05-23 12:11:02 +02:00
mixer.c ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() 2026-01-30 10:28:45 +01:00
mixer.h ALSA: usb-audio: Add input value sanity checks for standard types 2024-08-06 18:27:08 +02:00
mixer_maps.c ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card 2025-06-27 11:11:39 +01:00
mixer_quirks.c ALSA: usb-audio: move mixer_quirks' min_mute into common quirk 2025-10-02 13:44:07 +02:00
mixer_quirks.h ALSA: usb-audio: Drop CONFIG_PM ifdefs 2021-12-06 10:19:40 +01:00
mixer_s1810c.c ALSA: usb-audio: add mono main switch to Presonus S1824c 2025-11-13 15:34:31 -05:00
mixer_s1810c.h ALSA: usb-audio: Add support for Presonus Studio 1810c 2020-02-15 09:46:16 +01:00
mixer_scarlett.c ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
mixer_scarlett.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mixer_scarlett2.c ALSA: scarlett2: Fix buffer overflow in config retrieval 2026-01-30 10:28:45 +01:00
mixer_scarlett2.h ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 2023-10-27 11:22:59 +02:00
mixer_us16x08.c ALSA: usb-mixer: us16x08: validate meter packet indices 2026-01-08 10:14:08 +01:00
mixer_us16x08.h ALSA: usb: Constify snd_kcontrol_new items 2020-01-03 09:24:34 +01:00
pcm.c ALSA: usb-audio: Fix broken resume due to UAC3 power state 2023-06-16 09:28:08 +02:00
pcm.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2022-12-22 09:13:54 +01:00
power.c ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
power.h ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
proc.c ALSA: usb-audio: Show sync endpoint information in proc outputs 2020-11-23 15:16:45 +01:00
proc.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
quirks-table.h ALSA: usb-audio: Add extra PID for RME Digiface USB 2024-12-14 20:03:23 +01:00
quirks.c ALSA: usb-audio: Update for native DSD support quirks 2026-01-17 16:31:28 +01:00
quirks.h ALSA: usb-audio: Register card at the last interface 2022-09-06 11:04:56 +02:00
stream.c ALSA: usb-audio: Fix size validation in convert_chmap_v3() 2025-08-28 16:31:13 +02:00
stream.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
usbaudio.h ALSA: usb-audio: move mixer_quirks' min_mute into common quirk 2025-10-02 13:44:07 +02:00
validate.c ALSA: usb-audio: Add validation of UAC2/UAC3 effect units 2025-11-13 15:34:14 -05:00