OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ASoC: dapm: fix use-after-free issue with dailink sname 

Commit 7620fe9161 ("ASoC: topology: fix memory leak in
soc_tplg_dapm_widget_create") fixed a memory leak issue, but
additional tests and KASAN reports show a use-after-free in soc-dapm.

The widgets are created with a kmemdup operating on a template. The
"name" string is also duplicated, but the "sname" string is not. As a
result, when the template is freed after widget creation, its sname
string is still used.

Fix by explicitly duplicating the "sname" string, and freeing it when
required.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Pierre-Louis Bossart 2019-02-01 11:05:12 -06:00 committed by Mark Brown
parent 4bd8597dc3
commit 199ed3e81c
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
1 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
sound/soc/soc-dapm.c
View File

@ -295,7 +295,22 @@ EXPORT_SYMBOL_GPL(dapm_mark_endpoints_dirty);
static inline struct snd_soc_dapm_widget *dapm_cnew_widget(
const struct snd_soc_dapm_widget *_widget)
{
return kmemdup(_widget, sizeof(*_widget), GFP_KERNEL);
struct snd_soc_dapm_widget *w;
w = kmemdup(_widget, sizeof(*_widget), GFP_KERNEL);
if (!w)
return NULL;
/*
* w->name is duplicated in caller, but w->sname isn't.
* Duplicate it here if defined
*/
if (_widget->sname) {
w->sname = kstrdup_const(_widget->sname, GFP_KERNEL);
if (!w->sname)
return NULL;
}
return w;
}
struct dapm_kcontrol_data {
@ -2412,6 +2427,7 @@ void snd_soc_dapm_free_widget(struct snd_soc_dapm_widget *w)
kfree(w->kcontrols);
kfree_const(w->name);
kfree_const(w->sname);
kfree(w);
}
@ -3469,6 +3485,7 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm,
else
w->name = kstrdup_const(widget->name, GFP_KERNEL);
if (w->name == NULL) {
kfree_const(w->sname);
kfree(w);
return ERR_PTR(-ENOMEM);
}