kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/sound/usb
History
Jeongjun Park 353d8c715c ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free 
commit 9f2c0ac142 upstream.

The previous commit 0718a78f6a ("ALSA: usb-audio: Kill timer properly at
removal") patched a UAF issue caused by the error timer.

However, because the error timer kill added in this patch occurs after the
endpoint delete, a race condition to UAF still occurs, albeit rarely.

Additionally, since kill-cleanup for urb is also missing, freed memory can
be accessed in interrupt context related to urb, which can cause UAF.

Therefore, to prevent this, error timer and urb must be killed before
freeing the heap memory.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+f02665daa2abeef4a947@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f02665daa2abeef4a947
Fixes: 0718a78f6a ("ALSA: usb-audio: Kill timer properly at removal")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-06 11:20:05 +02:00
..
6fire ALSA: 6fire: Use safer strscpy() instead of strcpy() 2025-07-11 09:53:35 +02:00
bcd2000 ALSA: bcd2000: refactor deprecated strncpy 2023-07-29 13:53:56 +02:00
caiaq ALSA: caiaq: Use snd_card_free_when_closed() at disconnection 2024-11-13 13:33:47 +01:00
hiface ALSA: usb: Use *-y instead of *-objs in Makefile 2024-05-08 18:17:53 +02:00
line6 ALSA: line6: Use safer strscpy() instead of strcpy() 2025-07-11 09:53:35 +02:00
misc ALSA: ua101: Use safer strscpy() instead of strcpy() 2025-07-11 09:53:35 +02:00
qcom ALSA: usb: qcom: Fix false-positive address space check 2025-09-17 15:10:58 +02:00
usx2y ALSA: usx2y: Use safer strscpy() instead of strcpy() 2025-07-11 09:53:35 +02:00
card.c ALSA: usb-audio: Copy string more safely 2025-07-11 09:53:36 +02:00
card.h ALSA: usb-audio: Allow for rediscovery of connected USB SND devices 2025-04-11 13:02:31 +02:00
clock.c ALSA: usb-audio: Fix out of bounds reads when finding clock sources 2024-11-25 15:48:22 +01:00
clock.h ALSA: usb-audio: Constify audioformat pointer references 2020-11-23 15:15:36 +01:00
endpoint.c Merge 6.15-rc6 into usb-next 2025-05-13 08:26:58 +02:00
endpoint.h ALSA: usb-audio: Remove unused function declaration 2023-08-01 16:56:57 +02:00
fcp.c ALSA: usb: fcp: Use USB API functions rather than constants 2025-05-16 09:57:00 +02:00
fcp.h ALSA: FCP: Add Focusrite Control Protocol driver 2025-01-18 12:00:38 +01:00
format.c ALSA: usb-audio: Allow Focusrite devices to use low samplerates 2025-09-01 13:14:52 +02:00
format.h ALSA: usb: initial USB Audio Device Class 3.0 support 2018-03-21 11:46:33 +01:00
helper.c ALSA: usb-audio: Export USB SND APIs for modules 2025-04-11 13:02:30 +02:00
helper.h ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
implicit.c ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 2025-06-02 16:50:04 +02:00
implicit.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2022-12-22 09:13:54 +01:00
Kconfig ALSA: usb-audio: qcom: fix USB_XHCI dependency 2025-05-23 14:38:50 +02:00
Makefile ALSA: usb-audio: qcom: Introduce QC USB SND offloading support 2025-04-11 13:02:32 +02:00
media.c ALSA: pcm: Don't embed device 2023-08-17 09:23:45 +02:00
media.h media: sound/usb: Use Media Controller API to share media resources 2019-04-22 11:21:06 -04:00
midi.c ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free 2025-10-06 11:20:05 +02:00
midi.h ALSA: usb-audio: Manage number of rawmidis globally 2023-05-23 12:11:00 +02:00
midi2.c ALSA: usb-audio: Copy string more safely 2025-07-11 09:53:36 +02:00
midi2.h ALSA: usb-audio: USB MIDI 2.0 UMP support 2023-05-23 12:11:02 +02:00
mixer.c ALSA: usb-audio: Copy string more safely 2025-07-11 09:53:36 +02:00
mixer.h ALSA: usb-audio: Add input value sanity checks for standard types 2024-08-06 18:27:08 +02:00
mixer_maps.c ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card 2025-06-13 10:18:10 +02:00
mixer_quirks.c ALSA: usb-audio: move mixer_quirks' min_mute into common quirk 2025-08-27 07:53:25 +02:00
mixer_quirks.h ALSA: usb-audio: Drop CONFIG_PM ifdefs 2021-12-06 10:19:40 +01:00
mixer_s1810c.c ALSA: usb-audio: remove redundant assignment to variable c 2022-02-08 08:21:32 +01:00
mixer_s1810c.h ALSA: usb-audio: Add support for Presonus Studio 1810c 2020-02-15 09:46:16 +01:00
mixer_scarlett.c ALSA: usb-audio: Copy string more safely 2025-07-11 09:53:36 +02:00
mixer_scarlett.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mixer_scarlett2.c ALSA: usb: scarlett2: Fix missing NULL check 2025-07-31 17:04:28 +02:00
mixer_scarlett2.h ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 2023-10-27 11:22:59 +02:00
mixer_us16x08.c ALSA: usb: mixer_us16x08: use snd_kcontrol_chip() 2025-05-08 11:53:35 +02:00
mixer_us16x08.h ALSA: usb: Constify snd_kcontrol_new items 2020-01-03 09:24:34 +01:00
pcm.c ALSA: usb-audio: Don't use printk_ratelimit for debug prints 2025-08-02 16:17:50 +02:00
pcm.h ALSA: usb-audio: Export USB SND APIs for modules 2025-04-11 13:02:30 +02:00
power.c ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
power.h ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
proc.c ALSA: usb-audio: Copy string more safely 2025-07-11 09:53:36 +02:00
proc.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
quirks-table.h ALSA: usb-audio: Add Pioneer DJ DJM-V10 support 2025-04-22 15:00:48 +02:00
quirks.c ALSA: usb-audio: Add mute TLV for playback volumes on more devices 2025-08-29 09:50:14 +02:00
quirks.h ALSA: usb-audio: Register card at the last interface 2022-09-06 11:04:56 +02:00
stream.c ALSA: usb-audio: Fix size validation in convert_chmap_v3() 2025-08-18 12:36:33 +02:00
stream.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
usbaudio.h ALSA: usb-audio: move mixer_quirks' min_mute into common quirk 2025-08-27 07:53:25 +02:00
validate.c ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation 2025-08-21 17:10:14 +02:00