CVE-2022-50773

In the Linux kernel, the following vulnerability has been resolved:

ALSA: mts64: fix possible null-ptr-defer in sndmts64interrupt

I got a null-ptr-defer error report when I do the following tests on the qemu platform:

make defconfig and CONFIGPARPORT=m, CONFIGPARPORTPC=m, CONFIGSND_MTS64=m

Then making test scripts: cat>test_mod1.sh<<EOF modprobe snd-mts64 modprobe snd-mts64 EOF

Executing the script, perhaps several times, we will get a null-ptr-defer report, as follow:

syzkaller:~# ./testmod.sh sndmts64: probe of sndmts64.0 failed with error -5 modprobe: ERROR: could not insert 'sndmts64': No such device BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor write access in kernel mode #PF: errorcode(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 0 PID: 205 Comm: modprobe Not tainted 6.1.0-rc8-00588-g76dcd734eca2 #6 Call Trace: <IRQ> sndmts64interrupt+0x24/0xa0 [sndmts64] parportirqhandler+0x37/0x50 [parport] __handleirqeventpercpu+0x39/0x190 handleirqeventpercpu+0xa/0x30 handleirqevent+0x2f/0x50 handleedgeirq+0x99/0x1b0 __commoninterrupt+0x5d/0x100 commoninterrupt+0xa0/0xc0 </IRQ> <TASK> asmcommoninterrupt+0x22/0x40 RIP: 0010:rawwriteunlockirqrestore+0x11/0x30 parportclaim+0xbd/0x230 [parport] sndmts64probe+0x14a/0x465 [sndmts64] platformprobe+0x3f/0xa0 reallyprobe+0x129/0x2c0 __driverprobedevice+0x6d/0xc0 driverprobedevice+0x1a/0xa0 __deviceattachdriver+0x7a/0xb0 busforeach_drv+0x62/0xb0 __deviceattach+0xe4/0x180 busprobedevice+0x82/0xa0 deviceadd+0x550/0x920 platformdeviceadd+0x106/0x220 sndmts64attach+0x2e/0x80 [sndmts64] portcheck+0x14/0x20 [parport] busforeach_dev+0x6e/0xc0 __parportregisterdriver+0x7c/0xb0 [parport] sndmts64moduleinit+0x31/0x1000 [sndmts64] dooneinitcall+0x3c/0x1f0 doinitmodule+0x46/0x1c6 load_module+0x1d8d/0x1e10 _dosysfinitmodule+0xa2/0xf0 dosyscall64+0x37/0x90 entrySYSCALL64afterhwframe+0x63/0xcd </TASK> Kernel panic - not syncing: Fatal exception in interrupt Rebooting in 1 seconds..

The mts wa not initialized during interrupt, we add check for mts to fix this bug.