mirror of
https://github.com/torvalds/linux.git
synced 2024-11-26 14:12:06 +00:00
4fb44dd2c1
In snd_sb_qsound_build, snd_ctl_add(..,p->qsound_switch...) and snd_ctl_add(..,p->qsound_space..) are called. But the second arguments of snd_ctl_add() could be freed via snd_ctl_add_replace() ->snd_ctl_free_one(). After the error code is returned, snd_sb_qsound_destroy(p) is called in __error branch. But in snd_sb_qsound_destroy(), the freed p->qsound_switch and p->qsound_space are still used by snd_ctl_remove(). My patch set p->qsound_switch and p->qsound_space to NULL if snd_ctl_add() failed to avoid the uaf bugs. But these codes need to further be improved with the code style. Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20210426145541.8070-1-lyl2019@mail.ustc.edu.cn Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|---|---|---|
| .. | ||
| ad1816a | ||
| ad1848 | ||
| cs423x | ||
| es1688 | ||
| galaxy | ||
| gus | ||
| msnd | ||
| opti9xx | ||
| sb | ||
| wavefront | ||
| wss | ||
| adlib.c | ||
| als100.c | ||
| azt2320.c | ||
| cmi8328.c | ||
| cmi8330.c | ||
| es18xx.c | ||
| Kconfig | ||
| Makefile | ||
| opl3sa2.c | ||
| sc6000.c | ||
| sscape.c | ||