Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatter_pcm: fix stream_data leak on open error In xlnx_formatter_pcm_open(), stream_data is allocated and adata->play_stream or adata->capture_stream is assigned early. If a later step, such as snd_pcm_hw_constraint_step() or snd_pcm_hw_constraint_integer(), fails, the function returns the error immediately. ALSA does not call the close callback when open fails, so stream_data is leaked and the stream pointer is left dangling, pointing to a substream that ALSA frees. A later interrupt would then call snd_pcm_period_elapsed() on the freed substream. Free stream_data and clear the stream pointer on the error paths.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6f6c3c36f0917be24587eeba818ab4fdfcb5465a to < 5e1a2d9fff57f3a2b1a0f54d128d64245a253004affected6f6c3c36f0917be24587eeba818ab4fdfcb5465a to < edf81b293cba1b00a5e71becf184414f6991a6caaffected6f6c3c36f0917be24587eeba818ab4fdfcb5465a to < 3fd89a51b8cfe788df67f54b716b305dd45b8468affected6f6c3c36f0917be24587eeba818ab4fdfcb5465a to < 8c38ae4a465691947977c25d10394da22a64a19faffected6f6c3c36f0917be24587eeba818ab4fdfcb5465a to < 9030aa4e14b704dc39ee208207cb65064020d857affected6f6c3c36f0917be24587eeba818ab4fdfcb5465a to < 8b30628dfc2b2fad3b55a9441776a226035045faaffected6f6c3c36f0917be24587eeba818ab4fdfcb5465a to < 4e0ce77df7d9808926719d7950a07fbad14ea9efaffected6f6c3c36f0917be24587eeba818ab4fdfcb5465a to < b992511180e126150c6ad3580a6fd568c385f4c6affected
Linux Linux
Default version status: affected
5.1affected0 to < 5.1unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/5e1a2d9fff57f3a2b1a0f54d128d64245a253004 ↗
- https://git.kernel.org/stable/c/edf81b293cba1b00a5e71becf184414f6991a6ca ↗
- https://git.kernel.org/stable/c/3fd89a51b8cfe788df67f54b716b305dd45b8468 ↗
- https://git.kernel.org/stable/c/8c38ae4a465691947977c25d10394da22a64a19f ↗
- https://git.kernel.org/stable/c/9030aa4e14b704dc39ee208207cb65064020d857 ↗
- https://git.kernel.org/stable/c/8b30628dfc2b2fad3b55a9441776a226035045fa ↗
- https://git.kernel.org/stable/c/4e0ce77df7d9808926719d7950a07fbad14ea9ef ↗
- https://git.kernel.org/stable/c/b992511180e126150c6ad3580a6fd568c385f4c6 ↗