Re: [PATCH] ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()

From: Takashi Iwai
Date: Fri Jun 01 2018 - 03:39:35 EST


On Fri, 01 Jun 2018 00:35:18 +0200,
Bo Chen wrote:
>
> When 'kzalloc()' fails in 'snd_hda_attach_pcm_stream()', a new pcm instance is
> created without setting its operators via 'snd_pcm_set_ops()'. Following
> operations on the new pcm instance can trigger kernel null pointer dereferences
> and cause kernel oops.
>
> This bug was found with my work on building a gray-box fault-injection tool for
> linux-kernel-module binaries. A kernel null pointer dereference was confirmed
> from line 'substream->ops->open()' in function 'snd_pcm_open_substream()' in
> file 'sound/core/pcm_native.c'.
>
> This patch fixes the bug by calling 'snd_device_free()' in the error handling
> path of 'kzalloc()', which removes the new pcm instance from the snd card before
> returns with an error code.
>
> Signed-off-by: Bo Chen <chenbo@xxxxxxx>

Applied now. Thanks.


Takashi