Bad topology file paths when re-inserting snd_sof_pci_intel_tgl

Bad topology file paths when re-inserting snd_sof_pci_intel_tgl

[Tavian Barnes]

I'm trying to debug some audio issues on my ThinkPad X1 Carbon (Gen
10), and I noticed something that's probably a bug: when I remove and
re-insert the snd_sof_pci_intel_tgl module, it tries to load a
different tplg file every time.  Example:

# dmesg -t | grep tplg
sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
intel/sof-tplg/sof-hda-generic-idisp-4ch.tplg
# modprobe -r snd_sof_pci_intel_tgl
# modprobe snd_sof_pci_intel_tgl
# dmesg | grep tplg
sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
intel/sof-tplg/sof-hda-generic-idisp-4ch.tplg
sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
intel/sof-tplg/sof-hda-generic-idisp-idisp-4ch.tplg
# modprobe -r snd_sof_pci_intel_tgl
# modprobe snd_sof_pci_intel_tgl
# dmesg | grep tplg
sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
intel/sof-tplg/sof-hda-generic-idisp-4ch.tplg
sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
intel/sof-tplg/sof-hda-generic-idisp-idisp-4ch.tplg
sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
intel/sof-tplg/\xa0\x11\xaf\x0e\x8d\x8e\xff\xff\xb0\x11\xaf\x0e\x8d\x8e\xff\xff\xb0\x11\xaf\x0e\x8d\x8e\xff\xff-idisp-4ch.tplg

The second time, it added an extra -idisp to the path
(intel/sof-tplg/sof-hda-generic-idisp-idisp-4ch.tplg).  The third
time, the path seems to have become totally corrupted.

I'm seeing this on kernel version 6.14.3-arch1, which has no
sound-related changes from the regular stable 6.14.3 kernel.  I can
try current master but I don't see any relevant changes to the code
that adds -idisp in sound/soc/sof/intel/hda.c.

Re: Bad topology file paths when re-inserting snd_sof_pci_intel_tgl

[Takashi Iwai]

On Tue, 22 Apr 2025 20:48:40 +0200,
Tavian Barnes wrote:
> 
> I'm trying to debug some audio issues on my ThinkPad X1 Carbon (Gen
> 10), and I noticed something that's probably a bug: when I remove and
> re-insert the snd_sof_pci_intel_tgl module, it tries to load a
> different tplg file every time.  Example:
> 
> # dmesg -t | grep tplg
> sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> intel/sof-tplg/sof-hda-generic-idisp-4ch.tplg
> # modprobe -r snd_sof_pci_intel_tgl
> # modprobe snd_sof_pci_intel_tgl
> # dmesg | grep tplg
> sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> intel/sof-tplg/sof-hda-generic-idisp-4ch.tplg
> sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> intel/sof-tplg/sof-hda-generic-idisp-idisp-4ch.tplg
> # modprobe -r snd_sof_pci_intel_tgl
> # modprobe snd_sof_pci_intel_tgl
> # dmesg | grep tplg
> sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> intel/sof-tplg/sof-hda-generic-idisp-4ch.tplg
> sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> intel/sof-tplg/sof-hda-generic-idisp-idisp-4ch.tplg
> sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> intel/sof-tplg/\xa0\x11\xaf\x0e\x8d\x8e\xff\xff\xb0\x11\xaf\x0e\x8d\x8e\xff\xff\xb0\x11\xaf\x0e\x8d\x8e\xff\xff-idisp-4ch.tplg
> 
> The second time, it added an extra -idisp to the path
> (intel/sof-tplg/sof-hda-generic-idisp-idisp-4ch.tplg).  The third
> time, the path seems to have become totally corrupted.
> 
> I'm seeing this on kernel version 6.14.3-arch1, which has no
> sound-related changes from the regular stable 6.14.3 kernel.  I can
> try current master but I don't see any relevant changes to the code
> that adds -idisp in sound/soc/sof/intel/hda.c.

Looks like a bug introduced by the commit
5458411d75947a4212e50a401ec0a98d4c6c931b
    ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach
It overwrites hda_mach->sof_tplg_filename with a string of
devm_kasprintf().


thanks,

Takashi

[PATCH] ASoC: SOF: Intel: hda: Fix UAF when reloading module

[Tavian Barnes]

On Wed, Apr 23, 2025 at 3:27 AM Takashi Iwai <tiwai@suse.de> wrote:
> On Tue, 22 Apr 2025 20:48:40 +0200, Tavian Barnes wrote:
> >
> > I'm trying to debug some audio issues on my ThinkPad X1 Carbon (Gen
> > 10), and I noticed something that's probably a bug: when I remove and
> > re-insert the snd_sof_pci_intel_tgl module, it tries to load a
> > different tplg file every time.  Example:
> >
> > # dmesg -t | grep tplg
> > sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> > intel/sof-tplg/sof-hda-generic-idisp-4ch.tplg
> > # modprobe -r snd_sof_pci_intel_tgl
> > # modprobe snd_sof_pci_intel_tgl
> > # dmesg | grep tplg
> > sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> > intel/sof-tplg/sof-hda-generic-idisp-4ch.tplg
> > sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> > intel/sof-tplg/sof-hda-generic-idisp-idisp-4ch.tplg
> > # modprobe -r snd_sof_pci_intel_tgl
> > # modprobe snd_sof_pci_intel_tgl
> > # dmesg | grep tplg
> > sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> > intel/sof-tplg/sof-hda-generic-idisp-4ch.tplg
> > sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> > intel/sof-tplg/sof-hda-generic-idisp-idisp-4ch.tplg
> > sof-audio-pci-intel-tgl 0000:00:1f.3:  Topology file:
> > intel/sof-tplg/\xa0\x11\xaf\x0e\x8d\x8e\xff\xff\xb0\x11\xaf\x0e\x8d\x8e\xff\xff\xb0\x11\xaf\x0e\x8d\x8e\xff\xff-idisp-4ch.tplg
> >
> > The second time, it added an extra -idisp to the path
> > (intel/sof-tplg/sof-hda-generic-idisp-idisp-4ch.tplg).  The third
> > time, the path seems to have become totally corrupted.
> >
> > I'm seeing this on kernel version 6.14.3-arch1, which has no
> > sound-related changes from the regular stable 6.14.3 kernel.  I can
> > try current master but I don't see any relevant changes to the code
> > that adds -idisp in sound/soc/sof/intel/hda.c.
>
> Looks like a bug introduced by the commit
> 5458411d75947a4212e50a401ec0a98d4c6c931b
>     ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach
> It overwrites hda_mach->sof_tplg_filename with a string of
> devm_kasprintf().

Indeed, it happened to get caught by KFENCE just now (on 6.12.24-lts).
Suggested patch below:

From: Tavian Barnes <tavianator@tavianator.com>
Date: Wed, 23 Apr 2025 10:49:54 -0400

hda_generic_machine_select() appends -idisp to the tplg filename by
allocating a new string with devm_kasprintf(), then stores the string
right back into the global variable snd_soc_acpi_intel_hda_machines.
When the module is unloaded, this memory is freed, resulting in a global
variable pointing to freed memory.  Reloading the modules then triggers
a use-after-free:

BUG: KFENCE: use-after-free read in string+0x48/0xe0

Use-after-free read at 0x00000000967e0109 (in kfence-#99):
 string+0x48/0xe0
 vsnprintf+0x329/0x6e0
 devm_kvasprintf+0x54/0xb0
 devm_kasprintf+0x58/0x80
 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
 sof_probe_work+0x7f/0x600 [snd_sof]
 process_one_work+0x17b/0x330
 worker_thread+0x2ce/0x3f0
 kthread+0xcf/0x100
 ret_from_fork+0x31/0x50
 ret_from_fork_asm+0x1a/0x30

kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64

allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
 devm_kmalloc+0x52/0x120
 devm_kvasprintf+0x66/0xb0
 devm_kasprintf+0x58/0x80
 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
 sof_probe_work+0x7f/0x600 [snd_sof]
 process_one_work+0x17b/0x330
 worker_thread+0x2ce/0x3f0
 kthread+0xcf/0x100
 ret_from_fork+0x31/0x50
 ret_from_fork_asm+0x1a/0x30

freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
 release_nodes+0x43/0xb0
 devres_release_all+0x90/0xf0
 device_unbind_cleanup+0xe/0x70
 device_release_driver_internal+0x1c1/0x200
 driver_detach+0x48/0x90
 bus_remove_driver+0x6d/0xf0
 pci_unregister_driver+0x42/0xb0
 __do_sys_delete_module+0x1d1/0x310
 do_syscall_64+0x82/0x190
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fix it by saving the filename in sof_pdata->sof_tplg_filename instead,
just like every other code path that appends to the tplg filename.

Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
---
 sound/soc/sof/intel/hda.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
index b34e5fdf10f1..94854a24cba3 100644
--- a/sound/soc/sof/intel/hda.c
+++ b/sound/soc/sof/intel/hda.c
@@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
 				if (!tplg_filename)
 					return;
 
-				hda_mach->sof_tplg_filename = tplg_filename;
+				sof_pdata->sof_tplg_filename = tplg_filename;
 			}
 
 			if (codec_num == 2 ||
-- 
2.49.0

[PATCH v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module

[Tavian Barnes]

hda_generic_machine_select() appends -idisp to the tplg filename by
allocating a new string with devm_kasprintf(), then stores the string
right back into the global variable snd_soc_acpi_intel_hda_machines.
When the module is unloaded, this memory is freed, resulting in a global
variable pointing to freed memory.  Reloading the modules then triggers
a use-after-free:

BUG: KFENCE: use-after-free read in string+0x48/0xe0

Use-after-free read at 0x00000000967e0109 (in kfence-#99):
 string+0x48/0xe0
 vsnprintf+0x329/0x6e0
 devm_kvasprintf+0x54/0xb0
 devm_kasprintf+0x58/0x80
 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
 sof_probe_work+0x7f/0x600 [snd_sof]
 process_one_work+0x17b/0x330
 worker_thread+0x2ce/0x3f0
 kthread+0xcf/0x100
 ret_from_fork+0x31/0x50
 ret_from_fork_asm+0x1a/0x30

kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64

allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
 devm_kmalloc+0x52/0x120
 devm_kvasprintf+0x66/0xb0
 devm_kasprintf+0x58/0x80
 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
 sof_probe_work+0x7f/0x600 [snd_sof]
 process_one_work+0x17b/0x330
 worker_thread+0x2ce/0x3f0
 kthread+0xcf/0x100
 ret_from_fork+0x31/0x50
 ret_from_fork_asm+0x1a/0x30

freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
 release_nodes+0x43/0xb0
 devres_release_all+0x90/0xf0
 device_unbind_cleanup+0xe/0x70
 device_release_driver_internal+0x1c1/0x200
 driver_detach+0x48/0x90
 bus_remove_driver+0x6d/0xf0
 pci_unregister_driver+0x42/0xb0
 __do_sys_delete_module+0x1d1/0x310
 do_syscall_64+0x82/0x190
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fix it by saving the filename in pdata->tplg_filename instead, just like
every other code path that appends to the tplg filename.

Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
---
v2: Fix typo

 sound/soc/sof/intel/hda.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
index b34e5fdf10f1..1767977e7cff 100644
--- a/sound/soc/sof/intel/hda.c
+++ b/sound/soc/sof/intel/hda.c
@@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
 				if (!tplg_filename)
 					return;
 
-				hda_mach->sof_tplg_filename = tplg_filename;
+				pdata->tplg_filename = tplg_filename;
 			}
 
 			if (codec_num == 2 ||
-- 
2.49.0

[PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module

[Tavian Barnes]

hda_generic_machine_select() appends -idisp to the tplg filename by
allocating a new string with devm_kasprintf(), then stores the string
right back into the global variable snd_soc_acpi_intel_hda_machines.
When the module is unloaded, this memory is freed, resulting in a global
variable pointing to freed memory.  Reloading the modules then triggers
a use-after-free:

BUG: KFENCE: use-after-free read in string+0x48/0xe0

Use-after-free read at 0x00000000967e0109 (in kfence-#99):
 string+0x48/0xe0
 vsnprintf+0x329/0x6e0
 devm_kvasprintf+0x54/0xb0
 devm_kasprintf+0x58/0x80
 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
 sof_probe_work+0x7f/0x600 [snd_sof]
 process_one_work+0x17b/0x330
 worker_thread+0x2ce/0x3f0
 kthread+0xcf/0x100
 ret_from_fork+0x31/0x50
 ret_from_fork_asm+0x1a/0x30

kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64

allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
 devm_kmalloc+0x52/0x120
 devm_kvasprintf+0x66/0xb0
 devm_kasprintf+0x58/0x80
 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
 sof_probe_work+0x7f/0x600 [snd_sof]
 process_one_work+0x17b/0x330
 worker_thread+0x2ce/0x3f0
 kthread+0xcf/0x100
 ret_from_fork+0x31/0x50
 ret_from_fork_asm+0x1a/0x30

freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
 release_nodes+0x43/0xb0
 devres_release_all+0x90/0xf0
 device_unbind_cleanup+0xe/0x70
 device_release_driver_internal+0x1c1/0x200
 driver_detach+0x48/0x90
 bus_remove_driver+0x6d/0xf0
 pci_unregister_driver+0x42/0xb0
 __do_sys_delete_module+0x1d1/0x310
 do_syscall_64+0x82/0x190
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fix it by saving the filename in pdata->tplg_filename instead, just like
every other code path that appends to the tplg filename.

Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
---
v2: Fix typo

 sound/soc/sof/intel/hda.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
index b34e5fdf10f1..1767977e7cff 100644
--- a/sound/soc/sof/intel/hda.c
+++ b/sound/soc/sof/intel/hda.c
@@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
 				if (!tplg_filename)
 					return;
 
-				hda_mach->sof_tplg_filename = tplg_filename;
+				pdata->tplg_filename = tplg_filename;
 			}
 
 			if (codec_num == 2 ||
-- 
2.49.0

Re: [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module

[Liao, Bard]

On 5/6/2025 11:12 PM, Tavian Barnes wrote:
> hda_generic_machine_select() appends -idisp to the tplg filename by
> allocating a new string with devm_kasprintf(), then stores the string
> right back into the global variable snd_soc_acpi_intel_hda_machines.
> When the module is unloaded, this memory is freed, resulting in a global
> variable pointing to freed memory.  Reloading the modules then triggers
> a use-after-free:
> 
> BUG: KFENCE: use-after-free read in string+0x48/0xe0
> 
> Use-after-free read at 0x00000000967e0109 (in kfence-#99):
>  string+0x48/0xe0
>  vsnprintf+0x329/0x6e0
>  devm_kvasprintf+0x54/0xb0
>  devm_kasprintf+0x58/0x80
>  hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
>  sof_probe_work+0x7f/0x600 [snd_sof]
>  process_one_work+0x17b/0x330
>  worker_thread+0x2ce/0x3f0
>  kthread+0xcf/0x100
>  ret_from_fork+0x31/0x50
>  ret_from_fork_asm+0x1a/0x30
> 
> kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
> 
> allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
>  devm_kmalloc+0x52/0x120
>  devm_kvasprintf+0x66/0xb0
>  devm_kasprintf+0x58/0x80
>  hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
>  sof_probe_work+0x7f/0x600 [snd_sof]
>  process_one_work+0x17b/0x330
>  worker_thread+0x2ce/0x3f0
>  kthread+0xcf/0x100
>  ret_from_fork+0x31/0x50
>  ret_from_fork_asm+0x1a/0x30
> 
> freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
>  release_nodes+0x43/0xb0
>  devres_release_all+0x90/0xf0
>  device_unbind_cleanup+0xe/0x70
>  device_release_driver_internal+0x1c1/0x200
>  driver_detach+0x48/0x90
>  bus_remove_driver+0x6d/0xf0
>  pci_unregister_driver+0x42/0xb0
>  __do_sys_delete_module+0x1d1/0x310
>  do_syscall_64+0x82/0x190
>  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> 
> Fix it by saving the filename in pdata->tplg_filename instead, just like
> every other code path that appends to the tplg filename.
> 
> Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
> Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
> ---
> v2: Fix typo
> 
>  sound/soc/sof/intel/hda.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
> index b34e5fdf10f1..1767977e7cff 100644
> --- a/sound/soc/sof/intel/hda.c
> +++ b/sound/soc/sof/intel/hda.c
> @@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
>  				if (!tplg_filename)
>  					return;
>  
> -				hda_mach->sof_tplg_filename = tplg_filename;
> +				pdata->tplg_filename = tplg_filename;

It will break the existing tplg name fixup mechanism. Please see below
in hda_machine_select()
		if (!sof_pdata->tplg_filename) {
			/* remove file extension if it exists */
			tplg_filename = remove_file_ext(mach->sof_tplg_filename);
			if (!tplg_filename)
				return NULL;

			sof_pdata->tplg_filename = tplg_filename;
			tplg_fixup = true;
		}
With the change, sof_pdata->tplg_filename will be set and we won't do
tplg fixup for other components.

>  			}
>  
>  			if (codec_num == 2 ||

Re: [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module

[Péter Ujfalusi]

On 06/05/2025 18:12, Tavian Barnes wrote:
> hda_generic_machine_select() appends -idisp to the tplg filename by
> allocating a new string with devm_kasprintf(), then stores the string
> right back into the global variable snd_soc_acpi_intel_hda_machines.
> When the module is unloaded, this memory is freed, resulting in a global
> variable pointing to freed memory.  Reloading the modules then triggers
> a use-after-free:
> 
> BUG: KFENCE: use-after-free read in string+0x48/0xe0
> 
> Use-after-free read at 0x00000000967e0109 (in kfence-#99):
>  string+0x48/0xe0
>  vsnprintf+0x329/0x6e0
>  devm_kvasprintf+0x54/0xb0
>  devm_kasprintf+0x58/0x80
>  hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
>  sof_probe_work+0x7f/0x600 [snd_sof]
>  process_one_work+0x17b/0x330
>  worker_thread+0x2ce/0x3f0
>  kthread+0xcf/0x100
>  ret_from_fork+0x31/0x50
>  ret_from_fork_asm+0x1a/0x30
> 
> kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
> 
> allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
>  devm_kmalloc+0x52/0x120
>  devm_kvasprintf+0x66/0xb0
>  devm_kasprintf+0x58/0x80
>  hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
>  sof_probe_work+0x7f/0x600 [snd_sof]
>  process_one_work+0x17b/0x330
>  worker_thread+0x2ce/0x3f0
>  kthread+0xcf/0x100
>  ret_from_fork+0x31/0x50
>  ret_from_fork_asm+0x1a/0x30
> 
> freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
>  release_nodes+0x43/0xb0
>  devres_release_all+0x90/0xf0
>  device_unbind_cleanup+0xe/0x70
>  device_release_driver_internal+0x1c1/0x200
>  driver_detach+0x48/0x90
>  bus_remove_driver+0x6d/0xf0
>  pci_unregister_driver+0x42/0xb0
>  __do_sys_delete_module+0x1d1/0x310
>  do_syscall_64+0x82/0x190
>  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> 
> Fix it by saving the filename in pdata->tplg_filename instead, just like
> every other code path that appends to the tplg filename.
> 
> Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
> Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
> ---
> v2: Fix typo
> 
>  sound/soc/sof/intel/hda.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
> index b34e5fdf10f1..1767977e7cff 100644
> --- a/sound/soc/sof/intel/hda.c
> +++ b/sound/soc/sof/intel/hda.c
> @@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
>  				if (!tplg_filename)
>  					return;
>  
> -				hda_mach->sof_tplg_filename = tplg_filename;
> +				pdata->tplg_filename = tplg_filename;
>  			}
>  
>  			if (codec_num == 2 ||

I think the correct way would be to make a local copy of the
snd_soc_acpi_intel_hda_machines array as we might be modifying it:


/*
 * make a local copy of the match array since we might
 * be modifying it
 */
hda_mach = devm_kmemdup_array(sdev->dev,
		snd_soc_acpi_intel_hda_machines,
		2 /* we have one entry + sentinel in the array */,
		sizeof(snd_soc_acpi_intel_hda_machines[0]),
		GFP_KERNEL);
if (!hda_mach) {
	dev_err(bus->dev,
		"%s: Failed to duplicate the HDA match table\n",
		__func__);
	return;
}

or if the "2" is not satisfactory (we _know_ that the array size is 2
for this and will not change):
include/sound/soc-acpi-intel-match.h
+extern size_t snd_soc_acpi_num_intel_hda_machines;

sound/soc/intel/common/soc-acpi-intel-hda-match.c
+size_t snd_soc_acpi_num_intel_hda_machines =
ARRAY_SIZE(snd_soc_acpi_intel_hda_machines);
+EXPORT_SYMBOL_GPL(snd_soc_acpi_num_intel_hda_machines);

and:
/*
 * make a local copy of the match array since we might
 * be modifying it
 */
hda_mach = devm_kmemdup_array(sdev->dev,
		snd_soc_acpi_intel_hda_machines,
		snd_soc_acpi_num_intel_hda_machines,
		sizeof(snd_soc_acpi_intel_hda_machines[0]),
		GFP_KERNEL);
if (!hda_mach) {
	dev_err(bus->dev,
		"%s: Failed to duplicate the HDA match table\n",
		__func__);
	return;
}



-- 
Péter

Re: [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module

[Tavian Barnes]

On Wed, May 7, 2025 at 3:32 AM Péter Ujfalusi
<peter.ujfalusi@linux.intel.com> wrote:
> On 06/05/2025 18:12, Tavian Barnes wrote:
> > hda_generic_machine_select() appends -idisp to the tplg filename by
> > allocating a new string with devm_kasprintf(), then stores the string
> > right back into the global variable snd_soc_acpi_intel_hda_machines.
> > When the module is unloaded, this memory is freed, resulting in a global
> > variable pointing to freed memory.  Reloading the modules then triggers
> > a use-after-free:
> >
> > BUG: KFENCE: use-after-free read in string+0x48/0xe0
> >
> > Use-after-free read at 0x00000000967e0109 (in kfence-#99):
> >  string+0x48/0xe0
> >  vsnprintf+0x329/0x6e0
> >  devm_kvasprintf+0x54/0xb0
> >  devm_kasprintf+0x58/0x80
> >  hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> >  sof_probe_work+0x7f/0x600 [snd_sof]
> >  process_one_work+0x17b/0x330
> >  worker_thread+0x2ce/0x3f0
> >  kthread+0xcf/0x100
> >  ret_from_fork+0x31/0x50
> >  ret_from_fork_asm+0x1a/0x30
> >
> > kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
> >
> > allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
> >  devm_kmalloc+0x52/0x120
> >  devm_kvasprintf+0x66/0xb0
> >  devm_kasprintf+0x58/0x80
> >  hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> >  sof_probe_work+0x7f/0x600 [snd_sof]
> >  process_one_work+0x17b/0x330
> >  worker_thread+0x2ce/0x3f0
> >  kthread+0xcf/0x100
> >  ret_from_fork+0x31/0x50
> >  ret_from_fork_asm+0x1a/0x30
> >
> > freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
> >  release_nodes+0x43/0xb0
> >  devres_release_all+0x90/0xf0
> >  device_unbind_cleanup+0xe/0x70
> >  device_release_driver_internal+0x1c1/0x200
> >  driver_detach+0x48/0x90
> >  bus_remove_driver+0x6d/0xf0
> >  pci_unregister_driver+0x42/0xb0
> >  __do_sys_delete_module+0x1d1/0x310
> >  do_syscall_64+0x82/0x190
> >  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> >
> > Fix it by saving the filename in pdata->tplg_filename instead, just like
> > every other code path that appends to the tplg filename.
> >
> > Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
> > Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
> > ---
> > v2: Fix typo
> >
> >  sound/soc/sof/intel/hda.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
> > index b34e5fdf10f1..1767977e7cff 100644
> > --- a/sound/soc/sof/intel/hda.c
> > +++ b/sound/soc/sof/intel/hda.c
> > @@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
> >                               if (!tplg_filename)
> >                                       return;
> >
> > -                             hda_mach->sof_tplg_filename = tplg_filename;
> > +                             pdata->tplg_filename = tplg_filename;
> >                       }
> >
> >                       if (codec_num == 2 ||
>
> I think the correct way would be to make a local copy of the
> snd_soc_acpi_intel_hda_machines array as we might be modifying it:
>
>
> /*
>  * make a local copy of the match array since we might
>  * be modifying it
>  */
> hda_mach = devm_kmemdup_array(sdev->dev,
>                 snd_soc_acpi_intel_hda_machines,
>                 2 /* we have one entry + sentinel in the array */,
>                 sizeof(snd_soc_acpi_intel_hda_machines[0]),
>                 GFP_KERNEL);
> if (!hda_mach) {
>         dev_err(bus->dev,
>                 "%s: Failed to duplicate the HDA match table\n",
>                 __func__);
>         return;
> }
>
> or if the "2" is not satisfactory (we _know_ that the array size is 2
> for this and will not change):
> include/sound/soc-acpi-intel-match.h
> +extern size_t snd_soc_acpi_num_intel_hda_machines;
>
> sound/soc/intel/common/soc-acpi-intel-hda-match.c
> +size_t snd_soc_acpi_num_intel_hda_machines =
> ARRAY_SIZE(snd_soc_acpi_intel_hda_machines);
> +EXPORT_SYMBOL_GPL(snd_soc_acpi_num_intel_hda_machines);
>
> and:
> /*
>  * make a local copy of the match array since we might
>  * be modifying it
>  */
> hda_mach = devm_kmemdup_array(sdev->dev,
>                 snd_soc_acpi_intel_hda_machines,
>                 snd_soc_acpi_num_intel_hda_machines,
>                 sizeof(snd_soc_acpi_intel_hda_machines[0]),
>                 GFP_KERNEL);
> if (!hda_mach) {
>         dev_err(bus->dev,
>                 "%s: Failed to duplicate the HDA match table\n",
>                 __func__);
>         return;
> }

I don't think anything is relying on hda_mach being an array (correct
me if I'm wrong!).  So maybe just devm_kmemdup() is fine?  I'll test
it now.

Re: [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module

[Péter Ujfalusi]

On 06/05/2025 18:12, Tavian Barnes wrote:
> hda_generic_machine_select() appends -idisp to the tplg filename by
> allocating a new string with devm_kasprintf(), then stores the string
> right back into the global variable snd_soc_acpi_intel_hda_machines.
> When the module is unloaded, this memory is freed, resulting in a global
> variable pointing to freed memory.  Reloading the modules then triggers
> a use-after-free:
> 
> BUG: KFENCE: use-after-free read in string+0x48/0xe0
> 
> Use-after-free read at 0x00000000967e0109 (in kfence-#99):
>  string+0x48/0xe0
>  vsnprintf+0x329/0x6e0
>  devm_kvasprintf+0x54/0xb0
>  devm_kasprintf+0x58/0x80
>  hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
>  sof_probe_work+0x7f/0x600 [snd_sof]
>  process_one_work+0x17b/0x330
>  worker_thread+0x2ce/0x3f0
>  kthread+0xcf/0x100
>  ret_from_fork+0x31/0x50
>  ret_from_fork_asm+0x1a/0x30
> 
> kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
> 
> allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
>  devm_kmalloc+0x52/0x120
>  devm_kvasprintf+0x66/0xb0
>  devm_kasprintf+0x58/0x80
>  hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
>  sof_probe_work+0x7f/0x600 [snd_sof]
>  process_one_work+0x17b/0x330
>  worker_thread+0x2ce/0x3f0
>  kthread+0xcf/0x100
>  ret_from_fork+0x31/0x50
>  ret_from_fork_asm+0x1a/0x30
> 
> freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
>  release_nodes+0x43/0xb0
>  devres_release_all+0x90/0xf0
>  device_unbind_cleanup+0xe/0x70
>  device_release_driver_internal+0x1c1/0x200
>  driver_detach+0x48/0x90
>  bus_remove_driver+0x6d/0xf0
>  pci_unregister_driver+0x42/0xb0
>  __do_sys_delete_module+0x1d1/0x310
>  do_syscall_64+0x82/0x190
>  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> 
> Fix it by saving the filename in pdata->tplg_filename instead, just like
> every other code path that appends to the tplg filename.
> 
> Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
> Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
> ---
> v2: Fix typo
> 
>  sound/soc/sof/intel/hda.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
> index b34e5fdf10f1..1767977e7cff 100644
> --- a/sound/soc/sof/intel/hda.c
> +++ b/sound/soc/sof/intel/hda.c
> @@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
>  				if (!tplg_filename)
>  					return;
>  
> -				hda_mach->sof_tplg_filename = tplg_filename;
> +				pdata->tplg_filename = tplg_filename;

Did you sent this as a mistake? The v5 patch looks to be the correct
one, this is not.

>  			}
>  
>  			if (codec_num == 2 ||

-- 
Péter

Re: [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module

[Tavian Barnes]

On Thu, May 15, 2025 at 4:04 AM Péter Ujfalusi
<peter.ujfalusi@linux.intel.com> wrote:
> On 06/05/2025 18:12, Tavian Barnes wrote:
> > hda_generic_machine_select() appends -idisp to the tplg filename by
> > allocating a new string with devm_kasprintf(), then stores the string
> > right back into the global variable snd_soc_acpi_intel_hda_machines.
> > When the module is unloaded, this memory is freed, resulting in a global
> > variable pointing to freed memory.  Reloading the modules then triggers
> > a use-after-free:
> >
> > BUG: KFENCE: use-after-free read in string+0x48/0xe0
> >
> > Use-after-free read at 0x00000000967e0109 (in kfence-#99):
> >  string+0x48/0xe0
> >  vsnprintf+0x329/0x6e0
> >  devm_kvasprintf+0x54/0xb0
> >  devm_kasprintf+0x58/0x80
> >  hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> >  sof_probe_work+0x7f/0x600 [snd_sof]
> >  process_one_work+0x17b/0x330
> >  worker_thread+0x2ce/0x3f0
> >  kthread+0xcf/0x100
> >  ret_from_fork+0x31/0x50
> >  ret_from_fork_asm+0x1a/0x30
> >
> > kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
> >
> > allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
> >  devm_kmalloc+0x52/0x120
> >  devm_kvasprintf+0x66/0xb0
> >  devm_kasprintf+0x58/0x80
> >  hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> >  sof_probe_work+0x7f/0x600 [snd_sof]
> >  process_one_work+0x17b/0x330
> >  worker_thread+0x2ce/0x3f0
> >  kthread+0xcf/0x100
> >  ret_from_fork+0x31/0x50
> >  ret_from_fork_asm+0x1a/0x30
> >
> > freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
> >  release_nodes+0x43/0xb0
> >  devres_release_all+0x90/0xf0
> >  device_unbind_cleanup+0xe/0x70
> >  device_release_driver_internal+0x1c1/0x200
> >  driver_detach+0x48/0x90
> >  bus_remove_driver+0x6d/0xf0
> >  pci_unregister_driver+0x42/0xb0
> >  __do_sys_delete_module+0x1d1/0x310
> >  do_syscall_64+0x82/0x190
> >  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> >
> > Fix it by saving the filename in pdata->tplg_filename instead, just like
> > every other code path that appends to the tplg filename.
> >
> > Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
> > Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
> > ---
> > v2: Fix typo
> >
> >  sound/soc/sof/intel/hda.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
> > index b34e5fdf10f1..1767977e7cff 100644
> > --- a/sound/soc/sof/intel/hda.c
> > +++ b/sound/soc/sof/intel/hda.c
> > @@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
> >                               if (!tplg_filename)
> >                                       return;
> >
> > -                             hda_mach->sof_tplg_filename = tplg_filename;
> > +                             pdata->tplg_filename = tplg_filename;
>
> Did you sent this as a mistake? The v5 patch looks to be the correct
> one, this is not.

No?  I sent the above patch 8 days ago, v5 I sent yesterday.