Takashi Iwai 6ff1a25318 ALSA: usb-audio: Fix use-after-free of usb_device at disconnect ... The usb-audio driver implements the deferred device disconnection for the device in use. In this mode, the disconnection callback returns immediately while the actual ALSA card object removal happens later when all files get closed. As Shuah reported, this code flow, however, leads to a use-after-free, detected by KASAN: BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10 Write of size 8 by task pulseaudio/2244 Call Trace: [<ffffffff81b31473>] dump_stack+0x67/0x94 [<ffffffff81564ef1>] kasan_object_err+0x21/0x70 [<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0 [<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0 [<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50 [<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio] [<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio] [<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio] [<ffffffff8243c78a>] __snd_device_free+0x12a/0x210 [<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0 [<ffffffff8242cae4>] release_card_device+0x34/0x130 [<ffffffff81ef1846>] device_release+0x76/0x1e0 [<ffffffff81b37ad7>] kobject_release+0x107/0x370 ..... Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048 Allocated: [<ffffffff810804eb>] save_stack_trace+0x2b/0x50 [<ffffffff81564296>] save_stack+0x46/0xd0 [<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0 [<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240 [<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90 [<ffffffff8216349d>] hub_event+0xf1d/0x35f0 .... Freed: [<ffffffff810804eb>] save_stack_trace+0x2b/0x50 [<ffffffff81564296>] save_stack+0x46/0xd0 [<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0 [<ffffffff81560929>] kfree+0xd9/0x280 [<ffffffff8214de6e>] usb_release_dev+0xde/0x110 [<ffffffff81ef1846>] device_release+0x76/0x1e0 .... It's the code trying to clear drvdata of the assigned usb_device where the usb_device itself was already released in usb_release_dev() after the disconnect callback. This patch fixes it by checking whether the code path is via the disconnect callback, i.e. chip->shutdown flag is set. Fixes: 79289e2419 ('ALSA: usb-audio: Refer to chip->usb_id for quirks...') Reported-and-tested-by: Shuah Khan <shuahkh@osg.samsung.com> Cc: <stable@vger.kernel.org> # v4.6+ Signed-off-by: Takashi Iwai <tiwai@suse.de>		2016-11-14 22:05:04 +01:00
..
aoa	powerpc updates for 4.9	2016-10-07 20:19:31 -07:00
arm	ALSA: arm: Fix empty menuconfig SND_ARM	2016-08-01 16:07:53 +02:00
atmel
core	ALSA: info: Return error for invalid read/write	2016-11-08 14:37:26 +01:00
drivers
firewire	Merge branch 'for-linus' into for-next	2016-09-11 09:33:12 +02:00
hda	ALSA: hdac: add missing \n to end of dev_err messages	2016-09-16 19:23:57 +02:00
i2c
isa
mips
oss	sound: oss: Use kernel_read_file_from_path() for mod_firmware_load()	2016-07-26 10:38:03 +02:00
parisc
pci	ALSA: hda - Fix mic regression by ASRock mobo fixup	2016-11-11 12:33:20 +01:00
pcmcia
ppc	powerpc updates for 4.9	2016-10-07 20:19:31 -07:00
sh
soc	Merge remote-tracking branches 'asoc/fix/rt5663', 'asoc/fix/samsung', 'asoc/fix/sti', 'asoc/fix/sti-codec', 'asoc/fix/sunxi' and 'asoc/fix/tas571x' into asoc-linus	2016-11-04 12:33:56 -06:00
sparc
spi
synth
usb	ALSA: usb-audio: Fix use-after-free of usb_device at disconnect	2016-11-14 22:05:04 +01:00
ac97_bus.c
Kconfig
last.c
Makefile	sound: oss: Use kernel_read_file_from_path() for mod_firmware_load()	2016-07-26 10:38:03 +02:00
sound_core.c