ALSA: hda: Use linked list for jack table

So far we've used snd_array infrastructure for managing the
hda_jack_tbl elements, but it turned out that this may lead to a UAF
when a different order of destruction procedure is applied; namely,
each hda_jack_tbl object creates a snd_jack object and sets the
private_data pointing to the hda_jack_tbl, and private_free to release
it.  It looks harmless, but since snd_array may reallocate the whole
table at growing, the formerly referred jack pointer may become stale.

Fortunately, currently there is no call pattern that triggers this
issue, so it's only hypothetical, but we should address it in anyway.

There are several ways to address this, and at this time, we rather
redesign the hda_jack_tbl allocations: instead of snd_array(), do a
normal kmalloc() + linked list.  There will be more kmalloc calls than
the original code, but as the number of jacks are usually at most
handful, it must not be a problem.  This change allows us the
persistent jack pointer, so no stale pointer access can happen any
longer.

This also fixes another reported issue about the stale jack pointer
reference in snd_hda_jack_tbl_new(), too.

Fixes: 31ef22579302 ("ALSA: hda - Integrate input-jack stuff into kctl-jack")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20261007171057.7462-1-tiwai@suse.de

0 files changed, 0 insertions, 0 deletions