Patch "ALSA: usb-audio: Fix use-after-free of usb_device at disconnect" has been added to the 4.8-stable tree

This is a note to let you know that I've just added the patch titled

ALSA: usb-audio: Fix use-after-free of usb_device at disconnect

to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
alsa-usb-audio-fix-use-after-free-of-usb_device-at-disconnect.patch
and it can be found in the queue-4.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Takashi Iwai <[email protected]>
Date: Mon, 14 Nov 2016 21:46:47 +0100
Subject: ALSA: usb-audio: Fix use-after-free of usb_device at disconnect

From: Takashi Iwai <[email protected]>

commit 6ff1a25318ebf688ef9593fe09cd449f6fb4ad31 upstream.

The usb-audio driver implements the deferred device disconnection for the device in use. In this mode, the disconnection callback returns immediately while the actual ALSA card object removal happens later when all files get closed. As Shuah reported, this code flow, however, leads to a use-after-free, detected by KASAN:

 BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
 Write of size 8 by task pulseaudio/2244
 Call Trace:
  [<ffffffff81b31473>] dump_stack+0x67/0x94
  [<ffffffff81564ef1>] kasan_object_err+0x21/0x70
  [<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0
  [<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0
  [<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50
  [<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
  [<ffffffff8243c78a>] __snd_device_free+0x12a/0x210
  [<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0
  [<ffffffff8242cae4>] release_card_device+0x34/0x130
  [<ffffffff81ef1846>] device_release+0x76/0x1e0
  [<ffffffff81b37ad7>] kobject_release+0x107/0x370
  .....
 Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
 Allocated:
  [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
  [<ffffffff81564296>] save_stack+0x46/0xd0
  [<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0
  [<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240
  [<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90
  [<ffffffff8216349d>] hub_event+0xf1d/0x35f0
  ....
 Freed:
  [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
  [<ffffffff81564296>] save_stack+0x46/0xd0
  [<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0
  [<ffffffff81560929>] kfree+0xd9/0x280
  [<ffffffff8214de6e>] usb_release_dev+0xde/0x110
  [<ffffffff81ef1846>] device_release+0x76/0x1e0
  ....

It's the code trying to clear drvdata of the assigned usb_device where the usb_device itself was already released in usb_release_dev() after the disconnect callback.

This patch fixes it by checking whether the code path is via the disconnect callback, i.e. chip->shutdown flag is set.

---
 sound/usb/card.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -315,7 +315,8 @@ static int snd_usb_audio_free(struct snd
 		snd_usb_endpoint_free(ep);
 
 	mutex_destroy(&chip->mutex);
-	dev_set_drvdata(&chip->dev->dev, NULL);
+	if (!atomic_read(&chip->shutdown))
+		dev_set_drvdata(&chip->dev->dev, NULL);
 	kfree(chip);
 	return 0;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.8/alsa-hda-fix-mic-regression-by-asrock-mobo-fixup.patch queue-4.8/alsa-usb-audio-fix-use-after-free-of-usb_device-at-disconnect.patch queue-4.8/alsa-hda-add-a-new-condition-to-check-if-it-is-thinkpad.patch