commit e50ca59e75986ca7b388a18ee6e4a37d81f2fed7
author Hui Peng <benquike@gmail.com> Mon Dec 03 16:09:34 2018 +0100
committer Todd Kjos <tkjos@google.com> Fri Oct 04 14:48:37 2019 -0700
tree 35c3d56900bb63a7083aa370d7a78387f64b1c7d
parent d97147e5400b4734303487e540e6104afd6a3261

ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c

commit 5f8cf712582617d523120df67d392059eaf2fc4b upstream.

If a USB sound card reports 0 interfaces, an error condition is triggered
and the function usb_audio_probe errors out. In the error path, there was a
use-after-free vulnerability where the memory object of the card was first
freed, followed by a decrement of the number of active chips. Moving the
decrement above the atomic_dec fixes the UAF.

[ The original problem was introduced in 3.1 kernel, while it was
  developed in a different form.  The Fixes tag below indicates the
  original commit but it doesn't mean that the patch is applicable
  cleanly. -- tiwai ]

Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit")
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

sound/usb/card.c

diff --git a/sound/usb/card.c b/sound/usb/card.c
index 83336bb..084d413 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -589,9 +589,12 @@
 
  __error:
 	if (chip) {
+		/* chip->active is inside the chip->card object,
+		 * decrement before memory is possibly returned.
+		 */
+		atomic_dec(&chip->active);
 		if (!chip->num_interfaces)
 			snd_card_free(chip->card);
-		atomic_dec(&chip->active);
 	}
 	mutex_unlock(&register_mutex);
 	return err;