linux/sound/usb
Takashi Iwai 6ff1a25318 ALSA: usb-audio: Fix use-after-free of usb_device at disconnect
The usb-audio driver implements the deferred device disconnection for
the device in use.  In this mode, the disconnection callback returns
immediately while the actual ALSA card object removal happens later
when all files get closed.  As Shuah reported, this code flow,
however, leads to a use-after-free, detected by KASAN:

 BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
 Write of size 8 by task pulseaudio/2244
 Call Trace:
  [<ffffffff81b31473>] dump_stack+0x67/0x94
  [<ffffffff81564ef1>] kasan_object_err+0x21/0x70
  [<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0
  [<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0
  [<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50
  [<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
  [<ffffffff8243c78a>] __snd_device_free+0x12a/0x210
  [<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0
  [<ffffffff8242cae4>] release_card_device+0x34/0x130
  [<ffffffff81ef1846>] device_release+0x76/0x1e0
  [<ffffffff81b37ad7>] kobject_release+0x107/0x370
  .....
 Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
 Allocated:
  [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
  [<ffffffff81564296>] save_stack+0x46/0xd0
  [<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0
  [<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240
  [<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90
  [<ffffffff8216349d>] hub_event+0xf1d/0x35f0
  ....
 Freed:
  [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
  [<ffffffff81564296>] save_stack+0x46/0xd0
  [<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0
  [<ffffffff81560929>] kfree+0xd9/0x280
  [<ffffffff8214de6e>] usb_release_dev+0xde/0x110
  [<ffffffff81ef1846>] device_release+0x76/0x1e0
  ....

It's the code trying to clear drvdata of the assigned usb_device where
the usb_device itself was already released in usb_release_dev() after
the disconnect callback.

This patch fixes it by checking whether the code path is via the
disconnect callback, i.e. chip->shutdown flag is set.

Fixes: 79289e2419 ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
Reported-and-tested-by: Shuah Khan <shuahkh@osg.samsung.com>
Cc: <stable@vger.kernel.org> # v4.6+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-11-14 22:05:04 +01:00
..
6fire treewide: Fix typos in printk 2015-12-08 14:59:19 +01:00
bcd2000 ALSA: bcd2000: Make local data static 2015-05-26 13:00:01 +02:00
caiaq ALSA: usb: caiaq: audio: don't print error when allocating urb fails 2016-08-11 23:05:57 +02:00
hiface ALSA: usb: Convert to snd_card_new() with a device pointer 2014-02-12 11:18:00 +01:00
line6 ALSA: line6: fix a crash in line6_hwdep_write() 2016-10-12 20:10:23 +02:00
misc ALSA: ua101: replace le16_to_cpu() with usb_endpoint_maxp() 2015-11-16 09:03:06 +01:00
usx2y ALSA: usx2y: fix inconsistent indenting on if statement 2015-12-02 18:03:24 +01:00
Kconfig [media] Revert "[media] sound/usb: Use Media Controller API to share media resources" 2016-03-31 15:02:33 -03:00
Makefile [media] Revert "[media] sound/usb: Use Media Controller API to share media resources" 2016-03-31 15:02:33 -03:00
card.c ALSA: usb-audio: Fix use-after-free of usb_device at disconnect 2016-11-14 22:05:04 +01:00
card.h ALSA: usb: use TEAC UD-H01 quirk for more devices 2016-08-22 11:39:56 +02:00
clock.c ALSA: usb-audio: Limit retrying sample rate reads 2016-04-29 11:49:04 +02:00
clock.h ALSA: usb-audio: UAC2: do clock validity check earlier 2013-04-04 08:30:59 +02:00
debug.h ALSA: usb-audio: make hwc_debug a noop in case HW_CONST_DEBUG is not set 2011-05-18 11:44:35 +02:00
endpoint.c ALSA: usb: fine-tune Tenor error compensation value 2016-08-22 11:40:04 +02:00
endpoint.h ALSA: usb-audio: Pass direct struct pointer instead of list_head 2014-11-04 15:09:10 +01:00
format.c ALSA: usb-audio: rmove print for failure of kmalloc 2016-08-22 11:41:02 +02:00
format.h ALSA: usb-audio: store protocol version in struct audioformat 2013-06-27 21:59:47 +02:00
helper.c ALSA: usb-audio: correct speed checking 2016-05-08 11:42:04 +02:00
helper.h ALSA: usb-audio: increase control transfer timeout 2011-09-27 09:21:48 +02:00
midi.c ALSA: usb-midi: correct speed checking 2016-05-08 11:42:30 +02:00
midi.h ALSA: usb-audio: Refer to chip->usb_id for quirks and MIDI creation 2016-01-29 07:36:10 +01:00
mixer.c ALSA: usb-audio: allow clock source validity interrupts 2016-04-09 17:22:40 +02:00
mixer.h [media] Revert "[media] sound/usb: Use Media Controller API to share media resources" 2016-03-31 15:02:33 -03:00
mixer_maps.c ALSA: usb-audio: Change structure initialisation to C99 style 2016-06-17 16:58:41 +02:00
mixer_quirks.c ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants 2016-09-23 08:32:18 +02:00
mixer_quirks.h ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly 2015-12-14 10:13:17 +01:00
mixer_scarlett.c ALSA: usb-audio: Fix Scarlett 6i6 initialization typo 2014-12-18 08:39:17 +01:00
mixer_scarlett.h ALSA: usb-audio: Scarlett mixer interface for 6i6, 18i6, 18i8 and 18i20 2014-11-13 07:32:39 +01:00
pcm.c [media] Revert "[media] sound/usb: Use Media Controller API to share media resources" 2016-03-31 15:02:33 -03:00
pcm.h ALSA: usb: refine delay information with USB frame counter 2011-09-12 10:30:20 +02:00
power.h ALSA: usbaudio: implement USB autosuspend 2011-03-11 14:59:29 +01:00
proc.c ALSA: usb-audio: Avoid nested autoresume calls 2015-08-26 15:38:25 +02:00
proc.h ALSA: usb-audio: refactor code 2010-03-05 08:17:14 +01:00
quirks-table.h ALSA: usb-audio: Add quirk for Syntek STK1160 2016-10-27 12:07:19 +02:00
quirks.c Merge branch 'for-linus' into for-next 2016-09-11 09:33:12 +02:00
quirks.h ALSA: usb-audio: Refer to chip->usb_id for quirks and MIDI creation 2016-01-29 07:36:10 +01:00
stream.c media fixes for v4.6-rc2 2016-04-05 06:47:50 -07:00
stream.h ALSA: snd-usb: re-order code 2011-09-14 17:07:02 +02:00
usbaudio.h Merge branch 'for-linus' into for-next 2016-05-10 16:06:04 +02:00