* [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module
2025-04-23 16:50 ` [PATCH v2] " Tavian Barnes
@ 2025-05-06 15:12 ` Tavian Barnes
2025-05-07 5:09 ` Liao, Bard
` (2 subsequent siblings)
3 siblings, 0 replies; 10+ messages in thread
From: Tavian Barnes @ 2025-05-06 15:12 UTC (permalink / raw)
To: linux-sound
Cc: Tavian Barnes, Liam Girdwood, Peter Ujfalusi, Bard Liao,
Ranjani Sridharan, Daniel Baluta, Kai Vehmanen,
Pierre-Louis Bossart, Mark Brown, Jaroslav Kysela, Takashi Iwai,
Brent Lu, Peter Zijlstra, sound-open-firmware, linux-kernel
hda_generic_machine_select() appends -idisp to the tplg filename by
allocating a new string with devm_kasprintf(), then stores the string
right back into the global variable snd_soc_acpi_intel_hda_machines.
When the module is unloaded, this memory is freed, resulting in a global
variable pointing to freed memory. Reloading the modules then triggers
a use-after-free:
BUG: KFENCE: use-after-free read in string+0x48/0xe0
Use-after-free read at 0x00000000967e0109 (in kfence-#99):
string+0x48/0xe0
vsnprintf+0x329/0x6e0
devm_kvasprintf+0x54/0xb0
devm_kasprintf+0x58/0x80
hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
sof_probe_work+0x7f/0x600 [snd_sof]
process_one_work+0x17b/0x330
worker_thread+0x2ce/0x3f0
kthread+0xcf/0x100
ret_from_fork+0x31/0x50
ret_from_fork_asm+0x1a/0x30
kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
devm_kmalloc+0x52/0x120
devm_kvasprintf+0x66/0xb0
devm_kasprintf+0x58/0x80
hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
sof_probe_work+0x7f/0x600 [snd_sof]
process_one_work+0x17b/0x330
worker_thread+0x2ce/0x3f0
kthread+0xcf/0x100
ret_from_fork+0x31/0x50
ret_from_fork_asm+0x1a/0x30
freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
release_nodes+0x43/0xb0
devres_release_all+0x90/0xf0
device_unbind_cleanup+0xe/0x70
device_release_driver_internal+0x1c1/0x200
driver_detach+0x48/0x90
bus_remove_driver+0x6d/0xf0
pci_unregister_driver+0x42/0xb0
__do_sys_delete_module+0x1d1/0x310
do_syscall_64+0x82/0x190
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fix it by saving the filename in pdata->tplg_filename instead, just like
every other code path that appends to the tplg filename.
Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
---
v2: Fix typo
sound/soc/sof/intel/hda.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
index b34e5fdf10f1..1767977e7cff 100644
--- a/sound/soc/sof/intel/hda.c
+++ b/sound/soc/sof/intel/hda.c
@@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
if (!tplg_filename)
return;
- hda_mach->sof_tplg_filename = tplg_filename;
+ pdata->tplg_filename = tplg_filename;
}
if (codec_num == 2 ||
--
2.49.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module
2025-04-23 16:50 ` [PATCH v2] " Tavian Barnes
2025-05-06 15:12 ` [PATCH RESEND " Tavian Barnes
@ 2025-05-07 5:09 ` Liao, Bard
2025-05-07 7:33 ` Péter Ujfalusi
2025-05-15 8:05 ` Péter Ujfalusi
3 siblings, 0 replies; 10+ messages in thread
From: Liao, Bard @ 2025-05-07 5:09 UTC (permalink / raw)
To: Tavian Barnes, linux-sound
Cc: Liam Girdwood, Peter Ujfalusi, Ranjani Sridharan, Daniel Baluta,
Kai Vehmanen, Pierre-Louis Bossart, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Brent Lu, Peter Zijlstra, sound-open-firmware,
linux-kernel, bard.liao
On 5/6/2025 11:12 PM, Tavian Barnes wrote:
> hda_generic_machine_select() appends -idisp to the tplg filename by
> allocating a new string with devm_kasprintf(), then stores the string
> right back into the global variable snd_soc_acpi_intel_hda_machines.
> When the module is unloaded, this memory is freed, resulting in a global
> variable pointing to freed memory. Reloading the modules then triggers
> a use-after-free:
>
> BUG: KFENCE: use-after-free read in string+0x48/0xe0
>
> Use-after-free read at 0x00000000967e0109 (in kfence-#99):
> string+0x48/0xe0
> vsnprintf+0x329/0x6e0
> devm_kvasprintf+0x54/0xb0
> devm_kasprintf+0x58/0x80
> hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> sof_probe_work+0x7f/0x600 [snd_sof]
> process_one_work+0x17b/0x330
> worker_thread+0x2ce/0x3f0
> kthread+0xcf/0x100
> ret_from_fork+0x31/0x50
> ret_from_fork_asm+0x1a/0x30
>
> kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
>
> allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
> devm_kmalloc+0x52/0x120
> devm_kvasprintf+0x66/0xb0
> devm_kasprintf+0x58/0x80
> hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> sof_probe_work+0x7f/0x600 [snd_sof]
> process_one_work+0x17b/0x330
> worker_thread+0x2ce/0x3f0
> kthread+0xcf/0x100
> ret_from_fork+0x31/0x50
> ret_from_fork_asm+0x1a/0x30
>
> freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
> release_nodes+0x43/0xb0
> devres_release_all+0x90/0xf0
> device_unbind_cleanup+0xe/0x70
> device_release_driver_internal+0x1c1/0x200
> driver_detach+0x48/0x90
> bus_remove_driver+0x6d/0xf0
> pci_unregister_driver+0x42/0xb0
> __do_sys_delete_module+0x1d1/0x310
> do_syscall_64+0x82/0x190
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> Fix it by saving the filename in pdata->tplg_filename instead, just like
> every other code path that appends to the tplg filename.
>
> Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
> Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
> ---
> v2: Fix typo
>
> sound/soc/sof/intel/hda.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
> index b34e5fdf10f1..1767977e7cff 100644
> --- a/sound/soc/sof/intel/hda.c
> +++ b/sound/soc/sof/intel/hda.c
> @@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
> if (!tplg_filename)
> return;
>
> - hda_mach->sof_tplg_filename = tplg_filename;
> + pdata->tplg_filename = tplg_filename;
It will break the existing tplg name fixup mechanism. Please see below
in hda_machine_select()
if (!sof_pdata->tplg_filename) {
/* remove file extension if it exists */
tplg_filename = remove_file_ext(mach->sof_tplg_filename);
if (!tplg_filename)
return NULL;
sof_pdata->tplg_filename = tplg_filename;
tplg_fixup = true;
}
With the change, sof_pdata->tplg_filename will be set and we won't do
tplg fixup for other components.
> }
>
> if (codec_num == 2 ||
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module
2025-04-23 16:50 ` [PATCH v2] " Tavian Barnes
2025-05-06 15:12 ` [PATCH RESEND " Tavian Barnes
2025-05-07 5:09 ` Liao, Bard
@ 2025-05-07 7:33 ` Péter Ujfalusi
2025-05-07 14:04 ` Tavian Barnes
2025-05-15 8:05 ` Péter Ujfalusi
3 siblings, 1 reply; 10+ messages in thread
From: Péter Ujfalusi @ 2025-05-07 7:33 UTC (permalink / raw)
To: Tavian Barnes, linux-sound
Cc: Liam Girdwood, Bard Liao, Ranjani Sridharan, Daniel Baluta,
Kai Vehmanen, Pierre-Louis Bossart, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Brent Lu, Peter Zijlstra, sound-open-firmware,
linux-kernel
On 06/05/2025 18:12, Tavian Barnes wrote:
> hda_generic_machine_select() appends -idisp to the tplg filename by
> allocating a new string with devm_kasprintf(), then stores the string
> right back into the global variable snd_soc_acpi_intel_hda_machines.
> When the module is unloaded, this memory is freed, resulting in a global
> variable pointing to freed memory. Reloading the modules then triggers
> a use-after-free:
>
> BUG: KFENCE: use-after-free read in string+0x48/0xe0
>
> Use-after-free read at 0x00000000967e0109 (in kfence-#99):
> string+0x48/0xe0
> vsnprintf+0x329/0x6e0
> devm_kvasprintf+0x54/0xb0
> devm_kasprintf+0x58/0x80
> hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> sof_probe_work+0x7f/0x600 [snd_sof]
> process_one_work+0x17b/0x330
> worker_thread+0x2ce/0x3f0
> kthread+0xcf/0x100
> ret_from_fork+0x31/0x50
> ret_from_fork_asm+0x1a/0x30
>
> kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
>
> allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
> devm_kmalloc+0x52/0x120
> devm_kvasprintf+0x66/0xb0
> devm_kasprintf+0x58/0x80
> hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> sof_probe_work+0x7f/0x600 [snd_sof]
> process_one_work+0x17b/0x330
> worker_thread+0x2ce/0x3f0
> kthread+0xcf/0x100
> ret_from_fork+0x31/0x50
> ret_from_fork_asm+0x1a/0x30
>
> freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
> release_nodes+0x43/0xb0
> devres_release_all+0x90/0xf0
> device_unbind_cleanup+0xe/0x70
> device_release_driver_internal+0x1c1/0x200
> driver_detach+0x48/0x90
> bus_remove_driver+0x6d/0xf0
> pci_unregister_driver+0x42/0xb0
> __do_sys_delete_module+0x1d1/0x310
> do_syscall_64+0x82/0x190
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> Fix it by saving the filename in pdata->tplg_filename instead, just like
> every other code path that appends to the tplg filename.
>
> Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
> Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
> ---
> v2: Fix typo
>
> sound/soc/sof/intel/hda.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
> index b34e5fdf10f1..1767977e7cff 100644
> --- a/sound/soc/sof/intel/hda.c
> +++ b/sound/soc/sof/intel/hda.c
> @@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
> if (!tplg_filename)
> return;
>
> - hda_mach->sof_tplg_filename = tplg_filename;
> + pdata->tplg_filename = tplg_filename;
> }
>
> if (codec_num == 2 ||
I think the correct way would be to make a local copy of the
snd_soc_acpi_intel_hda_machines array as we might be modifying it:
/*
* make a local copy of the match array since we might
* be modifying it
*/
hda_mach = devm_kmemdup_array(sdev->dev,
snd_soc_acpi_intel_hda_machines,
2 /* we have one entry + sentinel in the array */,
sizeof(snd_soc_acpi_intel_hda_machines[0]),
GFP_KERNEL);
if (!hda_mach) {
dev_err(bus->dev,
"%s: Failed to duplicate the HDA match table\n",
__func__);
return;
}
or if the "2" is not satisfactory (we _know_ that the array size is 2
for this and will not change):
include/sound/soc-acpi-intel-match.h
+extern size_t snd_soc_acpi_num_intel_hda_machines;
sound/soc/intel/common/soc-acpi-intel-hda-match.c
+size_t snd_soc_acpi_num_intel_hda_machines =
ARRAY_SIZE(snd_soc_acpi_intel_hda_machines);
+EXPORT_SYMBOL_GPL(snd_soc_acpi_num_intel_hda_machines);
and:
/*
* make a local copy of the match array since we might
* be modifying it
*/
hda_mach = devm_kmemdup_array(sdev->dev,
snd_soc_acpi_intel_hda_machines,
snd_soc_acpi_num_intel_hda_machines,
sizeof(snd_soc_acpi_intel_hda_machines[0]),
GFP_KERNEL);
if (!hda_mach) {
dev_err(bus->dev,
"%s: Failed to duplicate the HDA match table\n",
__func__);
return;
}
--
Péter
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module
2025-05-07 7:33 ` Péter Ujfalusi
@ 2025-05-07 14:04 ` Tavian Barnes
0 siblings, 0 replies; 10+ messages in thread
From: Tavian Barnes @ 2025-05-07 14:04 UTC (permalink / raw)
To: Péter Ujfalusi
Cc: linux-sound, Liam Girdwood, Bard Liao, Ranjani Sridharan,
Daniel Baluta, Kai Vehmanen, Pierre-Louis Bossart, Mark Brown,
Jaroslav Kysela, Takashi Iwai, Brent Lu, Peter Zijlstra,
sound-open-firmware, linux-kernel
On Wed, May 7, 2025 at 3:32 AM Péter Ujfalusi
<peter.ujfalusi@linux.intel.com> wrote:
> On 06/05/2025 18:12, Tavian Barnes wrote:
> > hda_generic_machine_select() appends -idisp to the tplg filename by
> > allocating a new string with devm_kasprintf(), then stores the string
> > right back into the global variable snd_soc_acpi_intel_hda_machines.
> > When the module is unloaded, this memory is freed, resulting in a global
> > variable pointing to freed memory. Reloading the modules then triggers
> > a use-after-free:
> >
> > BUG: KFENCE: use-after-free read in string+0x48/0xe0
> >
> > Use-after-free read at 0x00000000967e0109 (in kfence-#99):
> > string+0x48/0xe0
> > vsnprintf+0x329/0x6e0
> > devm_kvasprintf+0x54/0xb0
> > devm_kasprintf+0x58/0x80
> > hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> > sof_probe_work+0x7f/0x600 [snd_sof]
> > process_one_work+0x17b/0x330
> > worker_thread+0x2ce/0x3f0
> > kthread+0xcf/0x100
> > ret_from_fork+0x31/0x50
> > ret_from_fork_asm+0x1a/0x30
> >
> > kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
> >
> > allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
> > devm_kmalloc+0x52/0x120
> > devm_kvasprintf+0x66/0xb0
> > devm_kasprintf+0x58/0x80
> > hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> > sof_probe_work+0x7f/0x600 [snd_sof]
> > process_one_work+0x17b/0x330
> > worker_thread+0x2ce/0x3f0
> > kthread+0xcf/0x100
> > ret_from_fork+0x31/0x50
> > ret_from_fork_asm+0x1a/0x30
> >
> > freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
> > release_nodes+0x43/0xb0
> > devres_release_all+0x90/0xf0
> > device_unbind_cleanup+0xe/0x70
> > device_release_driver_internal+0x1c1/0x200
> > driver_detach+0x48/0x90
> > bus_remove_driver+0x6d/0xf0
> > pci_unregister_driver+0x42/0xb0
> > __do_sys_delete_module+0x1d1/0x310
> > do_syscall_64+0x82/0x190
> > entry_SYSCALL_64_after_hwframe+0x76/0x7e
> >
> > Fix it by saving the filename in pdata->tplg_filename instead, just like
> > every other code path that appends to the tplg filename.
> >
> > Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
> > Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
> > ---
> > v2: Fix typo
> >
> > sound/soc/sof/intel/hda.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
> > index b34e5fdf10f1..1767977e7cff 100644
> > --- a/sound/soc/sof/intel/hda.c
> > +++ b/sound/soc/sof/intel/hda.c
> > @@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
> > if (!tplg_filename)
> > return;
> >
> > - hda_mach->sof_tplg_filename = tplg_filename;
> > + pdata->tplg_filename = tplg_filename;
> > }
> >
> > if (codec_num == 2 ||
>
> I think the correct way would be to make a local copy of the
> snd_soc_acpi_intel_hda_machines array as we might be modifying it:
>
>
> /*
> * make a local copy of the match array since we might
> * be modifying it
> */
> hda_mach = devm_kmemdup_array(sdev->dev,
> snd_soc_acpi_intel_hda_machines,
> 2 /* we have one entry + sentinel in the array */,
> sizeof(snd_soc_acpi_intel_hda_machines[0]),
> GFP_KERNEL);
> if (!hda_mach) {
> dev_err(bus->dev,
> "%s: Failed to duplicate the HDA match table\n",
> __func__);
> return;
> }
>
> or if the "2" is not satisfactory (we _know_ that the array size is 2
> for this and will not change):
> include/sound/soc-acpi-intel-match.h
> +extern size_t snd_soc_acpi_num_intel_hda_machines;
>
> sound/soc/intel/common/soc-acpi-intel-hda-match.c
> +size_t snd_soc_acpi_num_intel_hda_machines =
> ARRAY_SIZE(snd_soc_acpi_intel_hda_machines);
> +EXPORT_SYMBOL_GPL(snd_soc_acpi_num_intel_hda_machines);
>
> and:
> /*
> * make a local copy of the match array since we might
> * be modifying it
> */
> hda_mach = devm_kmemdup_array(sdev->dev,
> snd_soc_acpi_intel_hda_machines,
> snd_soc_acpi_num_intel_hda_machines,
> sizeof(snd_soc_acpi_intel_hda_machines[0]),
> GFP_KERNEL);
> if (!hda_mach) {
> dev_err(bus->dev,
> "%s: Failed to duplicate the HDA match table\n",
> __func__);
> return;
> }
I don't think anything is relying on hda_mach being an array (correct
me if I'm wrong!). So maybe just devm_kmemdup() is fine? I'll test
it now.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module
2025-04-23 16:50 ` [PATCH v2] " Tavian Barnes
` (2 preceding siblings ...)
2025-05-07 7:33 ` Péter Ujfalusi
@ 2025-05-15 8:05 ` Péter Ujfalusi
2025-05-15 12:19 ` Tavian Barnes
3 siblings, 1 reply; 10+ messages in thread
From: Péter Ujfalusi @ 2025-05-15 8:05 UTC (permalink / raw)
To: Tavian Barnes, linux-sound
Cc: Liam Girdwood, Bard Liao, Ranjani Sridharan, Daniel Baluta,
Kai Vehmanen, Pierre-Louis Bossart, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Brent Lu, Peter Zijlstra, sound-open-firmware,
linux-kernel
On 06/05/2025 18:12, Tavian Barnes wrote:
> hda_generic_machine_select() appends -idisp to the tplg filename by
> allocating a new string with devm_kasprintf(), then stores the string
> right back into the global variable snd_soc_acpi_intel_hda_machines.
> When the module is unloaded, this memory is freed, resulting in a global
> variable pointing to freed memory. Reloading the modules then triggers
> a use-after-free:
>
> BUG: KFENCE: use-after-free read in string+0x48/0xe0
>
> Use-after-free read at 0x00000000967e0109 (in kfence-#99):
> string+0x48/0xe0
> vsnprintf+0x329/0x6e0
> devm_kvasprintf+0x54/0xb0
> devm_kasprintf+0x58/0x80
> hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> sof_probe_work+0x7f/0x600 [snd_sof]
> process_one_work+0x17b/0x330
> worker_thread+0x2ce/0x3f0
> kthread+0xcf/0x100
> ret_from_fork+0x31/0x50
> ret_from_fork_asm+0x1a/0x30
>
> kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
>
> allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
> devm_kmalloc+0x52/0x120
> devm_kvasprintf+0x66/0xb0
> devm_kasprintf+0x58/0x80
> hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> sof_probe_work+0x7f/0x600 [snd_sof]
> process_one_work+0x17b/0x330
> worker_thread+0x2ce/0x3f0
> kthread+0xcf/0x100
> ret_from_fork+0x31/0x50
> ret_from_fork_asm+0x1a/0x30
>
> freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
> release_nodes+0x43/0xb0
> devres_release_all+0x90/0xf0
> device_unbind_cleanup+0xe/0x70
> device_release_driver_internal+0x1c1/0x200
> driver_detach+0x48/0x90
> bus_remove_driver+0x6d/0xf0
> pci_unregister_driver+0x42/0xb0
> __do_sys_delete_module+0x1d1/0x310
> do_syscall_64+0x82/0x190
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> Fix it by saving the filename in pdata->tplg_filename instead, just like
> every other code path that appends to the tplg filename.
>
> Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
> Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
> ---
> v2: Fix typo
>
> sound/soc/sof/intel/hda.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
> index b34e5fdf10f1..1767977e7cff 100644
> --- a/sound/soc/sof/intel/hda.c
> +++ b/sound/soc/sof/intel/hda.c
> @@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
> if (!tplg_filename)
> return;
>
> - hda_mach->sof_tplg_filename = tplg_filename;
> + pdata->tplg_filename = tplg_filename;
Did you sent this as a mistake? The v5 patch looks to be the correct
one, this is not.
> }
>
> if (codec_num == 2 ||
--
Péter
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module
2025-05-15 8:05 ` Péter Ujfalusi
@ 2025-05-15 12:19 ` Tavian Barnes
0 siblings, 0 replies; 10+ messages in thread
From: Tavian Barnes @ 2025-05-15 12:19 UTC (permalink / raw)
To: Péter Ujfalusi
Cc: linux-sound, Liam Girdwood, Bard Liao, Ranjani Sridharan,
Daniel Baluta, Kai Vehmanen, Pierre-Louis Bossart, Mark Brown,
Jaroslav Kysela, Takashi Iwai, Brent Lu, Peter Zijlstra,
sound-open-firmware, linux-kernel
On Thu, May 15, 2025 at 4:04 AM Péter Ujfalusi
<peter.ujfalusi@linux.intel.com> wrote:
> On 06/05/2025 18:12, Tavian Barnes wrote:
> > hda_generic_machine_select() appends -idisp to the tplg filename by
> > allocating a new string with devm_kasprintf(), then stores the string
> > right back into the global variable snd_soc_acpi_intel_hda_machines.
> > When the module is unloaded, this memory is freed, resulting in a global
> > variable pointing to freed memory. Reloading the modules then triggers
> > a use-after-free:
> >
> > BUG: KFENCE: use-after-free read in string+0x48/0xe0
> >
> > Use-after-free read at 0x00000000967e0109 (in kfence-#99):
> > string+0x48/0xe0
> > vsnprintf+0x329/0x6e0
> > devm_kvasprintf+0x54/0xb0
> > devm_kasprintf+0x58/0x80
> > hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> > sof_probe_work+0x7f/0x600 [snd_sof]
> > process_one_work+0x17b/0x330
> > worker_thread+0x2ce/0x3f0
> > kthread+0xcf/0x100
> > ret_from_fork+0x31/0x50
> > ret_from_fork_asm+0x1a/0x30
> >
> > kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
> >
> > allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
> > devm_kmalloc+0x52/0x120
> > devm_kvasprintf+0x66/0xb0
> > devm_kasprintf+0x58/0x80
> > hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
> > sof_probe_work+0x7f/0x600 [snd_sof]
> > process_one_work+0x17b/0x330
> > worker_thread+0x2ce/0x3f0
> > kthread+0xcf/0x100
> > ret_from_fork+0x31/0x50
> > ret_from_fork_asm+0x1a/0x30
> >
> > freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
> > release_nodes+0x43/0xb0
> > devres_release_all+0x90/0xf0
> > device_unbind_cleanup+0xe/0x70
> > device_release_driver_internal+0x1c1/0x200
> > driver_detach+0x48/0x90
> > bus_remove_driver+0x6d/0xf0
> > pci_unregister_driver+0x42/0xb0
> > __do_sys_delete_module+0x1d1/0x310
> > do_syscall_64+0x82/0x190
> > entry_SYSCALL_64_after_hwframe+0x76/0x7e
> >
> > Fix it by saving the filename in pdata->tplg_filename instead, just like
> > every other code path that appends to the tplg filename.
> >
> > Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
> > Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
> > ---
> > v2: Fix typo
> >
> > sound/soc/sof/intel/hda.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
> > index b34e5fdf10f1..1767977e7cff 100644
> > --- a/sound/soc/sof/intel/hda.c
> > +++ b/sound/soc/sof/intel/hda.c
> > @@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
> > if (!tplg_filename)
> > return;
> >
> > - hda_mach->sof_tplg_filename = tplg_filename;
> > + pdata->tplg_filename = tplg_filename;
>
> Did you sent this as a mistake? The v5 patch looks to be the correct
> one, this is not.
No? I sent the above patch 8 days ago, v5 I sent yesterday.
^ permalink raw reply [flat|nested] 10+ messages in thread