[BUG] media: cx88-alsa: Found a bug at the probe time

From: Zheyu Ma
Date: Thu Jul 14 2022 - 21:54:44 EST


Hello,

I found a bug in the driver cx88-alsa.

When the driver fails in the function snd_cx88_create() at the probe
time, it will cause a UAF bug as follows:

[ 24.343899] Trying to free already-free IRQ 0
[ 24.344815] WARNING: CPU: 7 PID: 389 at kernel/irq/manage.c:1895
free_irq+0x3a4/0x7c0
[ 24.348448] RIP: 0010:free_irq+0x3a4/0x7c0
[ 24.356716] Call Trace:
[ 24.357124] snd_cx88_dev_free+0x71/0x100 [cx88_alsa]
[ 24.358008] release_card_device+0x7d/0x190
[ 24.358699] device_release+0x97/0x1c0
[ 24.359022] kobject_put+0x144/0x1c0
[ 24.359329] snd_card_free+0xec/0x150
[ 24.360078] cx88_audio_initdev+0x8f4/0xce0 [cx88_alsa]

Since I'm not familiar with the driver, could you please give me some
hints to fix it?

regards,

Zheyu Ma