CVE-2022-49842

In the Linux kernel, the following vulnerability has been resolved:

ASoC: core: Fix use-after-free in sndsocexit()

KASAN reports a use-after-free:

BUG: KASAN: use-after-free in devicedel+0xb5b/0xc60 Read of size 8 at addr ffff888008655050 by task rmmod/387 CPU: 2 PID: 387 Comm: rmmod Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <TASK> dumpstacklvl+0x79/0x9a printreport+0x17f/0x47b kasanreport+0xbb/0xf0 devicedel+0xb5b/0xc60 platformdevicedel.part.0+0x24/0x200 platformdeviceunregister+0x2e/0x40 sndsocexit+0xa/0x22 [sndsoccore] _dosysdeletemodule.constprop.0+0x34f/0x5b0 dosyscall64+0x3a/0x90 entrySYSCALL64afterhwframe+0x63/0xcd ... </TASK>

It's bacause in sndsocinit(), sndsocutilinit() is possble to fail, but its ret is ignored, which makes socdummy_dev unregistered twice.

sndsocinit() sndsocutilinit() platformdeviceregistersimple(socdummydev) platformdriverregister() # fail platformdeviceunregister(socdummydev) platformdriverregister() # success ... sndsocexit() sndsocutilexit() # socdummy_dev will be unregistered for second time

To fix it, handle error and stop sndsocinit() when utilinit() fail. Also clean debugfs when utilinit() or driver_register() fail.