* [BUG] media: cx88-alsa: Found a bug at the probe time
@ 2022-07-15 1:54 Zheyu Ma
2022-07-16 19:03 ` Randy Dunlap
0 siblings, 1 reply; 3+ messages in thread
From: Zheyu Ma @ 2022-07-15 1:54 UTC (permalink / raw)
To: Mauro Carvalho Chehab; +Cc: linux-media, Linux Kernel Mailing List
Hello,
I found a bug in the driver cx88-alsa.
When the driver fails in the function snd_cx88_create() at the probe
time, it will cause a UAF bug as follows:
[ 24.343899] Trying to free already-free IRQ 0
[ 24.344815] WARNING: CPU: 7 PID: 389 at kernel/irq/manage.c:1895
free_irq+0x3a4/0x7c0
[ 24.348448] RIP: 0010:free_irq+0x3a4/0x7c0
[ 24.356716] Call Trace:
[ 24.357124] snd_cx88_dev_free+0x71/0x100 [cx88_alsa]
[ 24.358008] release_card_device+0x7d/0x190
[ 24.358699] device_release+0x97/0x1c0
[ 24.359022] kobject_put+0x144/0x1c0
[ 24.359329] snd_card_free+0xec/0x150
[ 24.360078] cx88_audio_initdev+0x8f4/0xce0 [cx88_alsa]
Since I'm not familiar with the driver, could you please give me some
hints to fix it?
regards,
Zheyu Ma
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [BUG] media: cx88-alsa: Found a bug at the probe time
2022-07-15 1:54 [BUG] media: cx88-alsa: Found a bug at the probe time Zheyu Ma
@ 2022-07-16 19:03 ` Randy Dunlap
2022-07-17 0:05 ` Zheyu Ma
0 siblings, 1 reply; 3+ messages in thread
From: Randy Dunlap @ 2022-07-16 19:03 UTC (permalink / raw)
To: Zheyu Ma, Mauro Carvalho Chehab; +Cc: linux-media, Linux Kernel Mailing List
Hi--
On 7/14/22 18:54, Zheyu Ma wrote:
> Hello,
>
> I found a bug in the driver cx88-alsa.
>
> When the driver fails in the function snd_cx88_create() at the probe
> time, it will cause a UAF bug as follows:
It's not a UAF. It's a WARN() macro with an IRQ management problem,
as shown in the next 2 lines below:
>
> [ 24.343899] Trying to free already-free IRQ 0
> [ 24.344815] WARNING: CPU: 7 PID: 389 at kernel/irq/manage.c:1895
> free_irq+0x3a4/0x7c0
> [ 24.348448] RIP: 0010:free_irq+0x3a4/0x7c0
> [ 24.356716] Call Trace:
> [ 24.357124] snd_cx88_dev_free+0x71/0x100 [cx88_alsa]
> [ 24.358008] release_card_device+0x7d/0x190
> [ 24.358699] device_release+0x97/0x1c0
> [ 24.359022] kobject_put+0x144/0x1c0
> [ 24.359329] snd_card_free+0xec/0x150
> [ 24.360078] cx88_audio_initdev+0x8f4/0xce0 [cx88_alsa]
>
> Since I'm not familiar with the driver, could you please give me some
> hints to fix it?
>
> regards,
>
> Zheyu Ma
--
~Randy
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [BUG] media: cx88-alsa: Found a bug at the probe time
2022-07-16 19:03 ` Randy Dunlap
@ 2022-07-17 0:05 ` Zheyu Ma
0 siblings, 0 replies; 3+ messages in thread
From: Zheyu Ma @ 2022-07-17 0:05 UTC (permalink / raw)
To: Randy Dunlap
Cc: Mauro Carvalho Chehab, linux-media, Linux Kernel Mailing List
On Sun, Jul 17, 2022 at 3:03 AM Randy Dunlap <rdunlap@infradead.org> wrote:
>
> Hi--
>
> On 7/14/22 18:54, Zheyu Ma wrote:
> > Hello,
> >
> > I found a bug in the driver cx88-alsa.
> >
> > When the driver fails in the function snd_cx88_create() at the probe
> > time, it will cause a UAF bug as follows:
>
> It's not a UAF. It's a WARN() macro with an IRQ management problem,
> as shown in the next 2 lines below:
You are right, that is indeed just a warning :)
regards,
Zheyu Ma
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-07-17 0:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-15 1:54 [BUG] media: cx88-alsa: Found a bug at the probe time Zheyu Ma
2022-07-16 19:03 ` Randy Dunlap
2022-07-17 0:05 ` Zheyu Ma
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).