Commit 82fa3e95 authored by Hui Peng's avatar Hui Peng Committed by Greg Kroah-Hartman

ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c

commit 5f8cf712582617d523120df67d392059eaf2fc4b upstream.

If a USB sound card reports 0 interfaces, an error condition is triggered
and the function usb_audio_probe errors out. In the error path, there was a
use-after-free vulnerability where the memory object of the card was first
freed, followed by a decrement of the number of active chips. Moving the
decrement above the atomic_dec fixes the UAF.

[ The original problem was introduced in 3.1 kernel, while it was
  developed in a different form.  The Fixes tag below indicates the
  original commit but it doesn't mean that the patch is applicable
  cleanly. -- tiwai ]

Fixes: 362e4e49 ("ALSA: usb-audio - clear chip->probing on error exit")
Reported-by: default avatarHui Peng <>
Reported-by: default avatarMathias Payer <>
Signed-off-by: default avatarHui Peng <>
Signed-off-by: default avatarMathias Payer <>
Cc: <>
Signed-off-by: default avatarTakashi Iwai <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent c380600b
...@@ -589,9 +589,12 @@ static int usb_audio_probe(struct usb_interface *intf, ...@@ -589,9 +589,12 @@ static int usb_audio_probe(struct usb_interface *intf,
__error: __error:
if (chip) { if (chip) {
/* chip->active is inside the chip->card object,
* decrement before memory is possibly returned.
if (!chip->num_interfaces) if (!chip->num_interfaces)
snd_card_free(chip->card); snd_card_free(chip->card);
} }
mutex_unlock(&register_mutex); mutex_unlock(&register_mutex);
return err; return err;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment