• Bo Chen's avatar
    ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream() · a3aa60d5
    Bo Chen authored
    When 'kzalloc()' fails in 'snd_hda_attach_pcm_stream()', a new pcm instance is
    created without setting its operators via 'snd_pcm_set_ops()'. Following
    operations on the new pcm instance can trigger kernel null pointer dereferences
    and cause kernel oops.
    
    This bug was found with my work on building a gray-box fault-injection tool for
    linux-kernel-module binaries. A kernel null pointer dereference was confirmed
    from line 'substream->ops->open()' in function 'snd_pcm_open_substream()' in
    file 'sound/core/pcm_native.c'.
    
    This patch fixes the bug by calling 'snd_device_free()' in the error handling
    path of 'kzalloc()', which removes the new pcm instance from the snd card before
    returns with an error code.
    Signed-off-by: default avatarBo Chen <chenbo@pdx.edu>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    a3aa60d5
hda_controller.c 36.6 KB