• Takashi Iwai's avatar
    ALSA: usb-audio: Fix use-after-free of usb_device at disconnect · 6ff1a253
    Takashi Iwai authored
    The usb-audio driver implements the deferred device disconnection for
    the device in use.  In this mode, the disconnection callback returns
    immediately while the actual ALSA card object removal happens later
    when all files get closed.  As Shuah reported, this code flow,
    however, leads to a use-after-free, detected by KASAN:
    
     BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
     Write of size 8 by task pulseaudio/2244
     Call Trace:
      [<ffffffff81b31473>] dump_stack+0x67/0x94
      [<ffffffff81564ef1>] kasan_object_err+0x21/0x70
      [<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0
      [<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0
      [<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50
      [<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
      [<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
      [<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
      [<ffffffff8243c78a>] __snd_device_free+0x12a/0x210
      [<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0
      [<ffffffff8242cae4>] release_card_device+0x34/0x130
      [<ffffffff81ef1846>] device_release+0x76/0x1e0
      [<ffffffff81b37ad7>] kobject_release+0x107/0x370
      .....
     Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
     Allocated:
      [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
      [<ffffffff81564296>] save_stack+0x46/0xd0
      [<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0
      [<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240
      [<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90
      [<ffffffff8216349d>] hub_event+0xf1d/0x35f0
      ....
     Freed:
      [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
      [<ffffffff81564296>] save_stack+0x46/0xd0
      [<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0
      [<ffffffff81560929>] kfree+0xd9/0x280
      [<ffffffff8214de6e>] usb_release_dev+0xde/0x110
      [<ffffffff81ef1846>] device_release+0x76/0x1e0
      ....
    
    It's the code trying to clear drvdata of the assigned usb_device where
    the usb_device itself was already released in usb_release_dev() after
    the disconnect callback.
    
    This patch fixes it by checking whether the code path is via the
    disconnect callback, i.e. chip->shutdown flag is set.
    
    Fixes: 79289e24 ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
    Reported-and-tested-by: default avatarShuah Khan <shuahkh@osg.samsung.com>
    Cc: <stable@vger.kernel.org> # v4.6+
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    6ff1a253
card.c 22.4 KB