Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <5fc2c89d-5aaf-3b81-64cc-7e69b16266c9@infradead.org>
Date:   Sat, 16 Jul 2022 12:03:25 -0700
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.11.0
Subject: Re: [BUG] media: cx88-alsa: Found a bug at the probe time
Content-Language: en-US
To:     Zheyu Ma <zheyuma97@gmail.com>,
        Mauro Carvalho Chehab <mchehab@kernel.org>
Cc:     linux-media <linux-media@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
References: <CAMhUBj=bs8rbiPGX1qOv9FSU8m=TdRZqqJGvRcynKbaWwf_A-A@mail.gmail.com>
From:   Randy Dunlap <rdunlap@infradead.org>
In-Reply-To: <CAMhUBj=bs8rbiPGX1qOv9FSU8m=TdRZqqJGvRcynKbaWwf_A-A@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hi--

On 7/14/22 18:54, Zheyu Ma wrote:
> Hello,
> 
> I found a bug in the driver cx88-alsa.
> 
> When the driver fails in the function snd_cx88_create() at the probe
> time, it will cause a UAF bug as follows:

It's not a UAF. It's a WARN() macro with an IRQ management problem,
as shown in the next 2 lines below:
> 
> [   24.343899] Trying to free already-free IRQ 0
> [   24.344815] WARNING: CPU: 7 PID: 389 at kernel/irq/manage.c:1895
> free_irq+0x3a4/0x7c0
> [   24.348448] RIP: 0010:free_irq+0x3a4/0x7c0
> [   24.356716] Call Trace:
> [   24.357124]  snd_cx88_dev_free+0x71/0x100 [cx88_alsa]
> [   24.358008]  release_card_device+0x7d/0x190
> [   24.358699]  device_release+0x97/0x1c0
> [   24.359022]  kobject_put+0x144/0x1c0
> [   24.359329]  snd_card_free+0xec/0x150
> [   24.360078]  cx88_audio_initdev+0x8f4/0xce0 [cx88_alsa]
> 
> Since I'm not familiar with the driver, could you please give me some
> hints to fix it?
> 
> regards,
> 
> Zheyu Ma

-- 
~Randy