ALSA: usb-audio: Fix use-after-free of usb_device at disconnect
The usb-audio driver implements the deferred device disconnection for the device in use. In this mode, the disconnection callback returns immediately while the actual ALSA card object removal happens later when all files get closed. As Shuah reported, this code flow, however, leads to a use-after-free, detected by KASAN: BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10 Write of size 8 by task pulseaudio/2244 Call Trace: [<ffffffff81b31473>] dump_stack+0x67/0x94 [<ffffffff81564ef1>] kasan_object_err+0x21/0x70 [<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0 [<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0 [<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50 [<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio] [<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio] [<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio...
parent
9a254191
Please register or sign in to comment