From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Takashi Iwai <tiwai@suse.de>, Sasha Levin <sashal@kernel.org>,
alsa-devel@alsa-project.org
Subject: [PATCH AUTOSEL 4.4 10/23] ALSA: sb: Fix potential double-free of CSP mixer elements
Date: Fri, 9 Jul 2021 22:38:59 -0400 [thread overview]
Message-ID: <20210710023912.3172972-10-sashal@kernel.org> (raw)
In-Reply-To: <20210710023912.3172972-1-sashal@kernel.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit c305366a37441c2ac90b08711cb6f032b43672f2 ]
snd_sb_qsound_destroy() contains the calls of removing the previously
created mixer controls, but it doesn't clear the pointers. As
snd_sb_qsound_destroy() itself may be repeatedly called via ioctl,
this could lead to double-free potentially.
Fix it by clearing the struct fields properly afterwards.
Link: https://lore.kernel.org/r/20210608140540.17885-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/isa/sb/sb16_csp.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
index 2cc068be7d3b..90fa57ad14c0 100644
--- a/sound/isa/sb/sb16_csp.c
+++ b/sound/isa/sb/sb16_csp.c
@@ -1086,10 +1086,14 @@ static void snd_sb_qsound_destroy(struct snd_sb_csp * p)
card = p->chip->card;
down_write(&card->controls_rwsem);
- if (p->qsound_switch)
+ if (p->qsound_switch) {
snd_ctl_remove(card, p->qsound_switch);
- if (p->qsound_space)
+ p->qsound_switch = NULL;
+ }
+ if (p->qsound_space) {
snd_ctl_remove(card, p->qsound_space);
+ p->qsound_space = NULL;
+ }
up_write(&card->controls_rwsem);
/* cancel pending transfer of QSound parameters */
--
2.30.2
next prev parent reply other threads:[~2021-07-10 2:43 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-10 2:38 [PATCH AUTOSEL 4.4 01/23] tty: serial: fsl_lpuart: fix the potential risk of division or modulo by zero Sasha Levin
2021-07-10 2:38 ` [PATCH AUTOSEL 4.4 02/23] misc/libmasm/module: Fix two use after free in ibmasm_init_one Sasha Levin
2021-07-10 2:38 ` [PATCH AUTOSEL 4.4 03/23] Revert "ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro" Sasha Levin
2021-07-10 2:38 ` [PATCH AUTOSEL 4.4 04/23] scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology Sasha Levin
2021-07-10 2:38 ` [PATCH AUTOSEL 4.4 05/23] tty: serial: 8250: serial_cs: Fix a memory leak in error handling path Sasha Levin
2021-07-10 2:38 ` [PATCH AUTOSEL 4.4 06/23] fs/jfs: Fix missing error code in lmLogInit() Sasha Levin
2021-07-10 2:38 ` [PATCH AUTOSEL 4.4 07/23] scsi: iscsi: Add iscsi_cls_conn refcount helpers Sasha Levin
2021-07-10 2:38 ` [PATCH AUTOSEL 4.4 08/23] mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE Sasha Levin
2021-07-10 2:38 ` [PATCH AUTOSEL 4.4 09/23] USB: core: Avoid WARNings for 0-length descriptor requests Sasha Levin
2021-07-10 2:38 ` Sasha Levin [this message]
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 11/23] powerpc/ps3: Add dma_mask to ps3_dma_region Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 12/23] gpio: zynq: Check return value of pm_runtime_get_sync Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 13/23] ALSA: ppc: fix error return code in snd_pmac_probe() Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 14/23] selftests/powerpc: Fix "no_handler" EBB selftest Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 15/23] ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 16/23] ALSA: bebob: add support for ToneWeal FW66 Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 17/23] usb: gadget: f_hid: fix endianness issue with descriptors Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 18/23] usb: gadget: hid: fix error return code in hid_bind() Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 19/23] powerpc/boot: Fixup device-tree on little endian Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 20/23] backlight: lm3630a: Fix return code of .update_status() callback Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 21/23] ALSA: hda: Add IRQ check for platform_get_irq() Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 22/23] jfs: fix GPF in diFree Sasha Levin
2021-07-10 2:39 ` [PATCH AUTOSEL 4.4 23/23] lib/decompress_unlz4.c: correctly handle zero-padding around initrds Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210710023912.3172972-10-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=alsa-devel@alsa-project.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).