ALSA: asihpi: free IRQ before snd_card_free()/HPI delete on HPI6205 removal (UAF)

[徐晗翔 <xuhx@hust.edu.cn>]

`snd_asihpi_remove()` frees the ALSA card and then sends HPI_ADAPTER_DELETE
(which frees the HPI6205 `phw`) before `free_irq()`.  Both the primary IRQ
handler and the threaded handler can therefore run against freed memory:
the primary handler dereferences `phw->prHSR` through
`adapter_irq_query_and_clear()`, and the threaded callback dereferences
`a->snd_card->private_data` after the card private area has been freed.

The detailed description:

* Test environment / affected version

  Linux 7.3.0 source tree.  Affected hardware path: ASI6205/HPI6205 in
  interrupt mode (`low_latency_mode && irq_supported`, `interrupt_mode=1`).
  HPI6000 does not set `irq_query_and_clear` and is polled, so it is not part
  of this report.

* Mechanism

  `snd_asihpi_remove()` (`sound/pci/asihpi/asihpi.c:2919-2933`):

    hpi->interrupt_callback = NULL;          /* if interrupt_mode */
    ... send HPI IRQ rate 0 ...
    snd_card_free(hpi->snd_card);            /* line 2930 */
    hpi->snd_card = NULL;                    /* line 2931 */
    asihpi_adapter_remove(pci_dev);          /* line 2932 */

  `asihpi_adapter_remove()` (`hpioctl.c:520-555`) then sends IRQ rate 0,
  sends `HPI_ADAPTER_DELETE` (537-540), and only afterwards calls
  `free_irq(pa->irq, pa)` (542-543).

  HPI6205 `adapter_delete()` (`hpi6205.c:491-510`) -> `delete_adapter_obj()`
  (`hpi6205.c:675-704`) does `kfree(phw)` at 703 without clearing
  `pao->priv`, then `hpi_delete_adapter()` (`hpicmn.c:96-108`) memsets the
  registry object at 106.  The primary handler `asihpi_isr()`
  (`hpioctl.c:311-335`) checks `a->adapter->irq_query_and_clear` and calls
  it; HPI6205 installs that handler at `hpi6205.c:662`, and
  `adapter_irq_query_and_clear()` (`hpi6205.c:708-722`) does
  `ioread32(phw->prHSR)` at 714.

  Window A (phw UAF): the handler loads the function pointer before
  `delete_adapter_obj()` frees `phw`, and executes after the free.

  Window B (NULL deref): the handler executes after `hpi_delete_adapter()`
  memsets the registry, so `pao->priv` is NULL and `phw->prHSR` is a NULL
  dereference.

  Window C (card private UAF): `asihpi_isr_thread()` (`hpioctl.c:337-344`)
  calls `a->interrupt_callback(a)`; `snd_card_asihpi_isr()`
  (`asihpi.c:898-907`) reads `a->snd_card->private_data` and
  `asihpi->llmode_streampriv`.  The card private area is allocated by
  `snd_card_new(..., sizeof(struct snd_card_asihpi), ...)`
  (`asihpi.c:2794-2799`) and freed by `snd_card_do_free()`
  (`sound/core/init.c:584-611`, `kfree(card)` at 610).  After
  `hpi->snd_card = NULL`, the same callback can also return NULL from the
  `snd_card` load and hit the WARN_ON/NULL path.

* Why existing synchronization does not close the window

  asihpi never sets `card->sync_irq`, so `snd_card_disconnect()` does not call
  `synchronize_irq()`.  `snd_card_free()` waits for open files and the card
  release completion, not for the IRQ handler/thread.  `free_irq()` is the
  first operation that quiesces the IRQ, and it happens after `snd_card_free()`
  and after HPI_ADAPTER_DELETE has freed `phw`.

* Trigger model

  HPI6205 device in IRQ mode; remove/unbind the PCI device.  Root is needed
  for unbind/remove.  Consequence: UAF/NULL deref in hard IRQ or threaded IRQ
  context; crash or memory corruption.  The report does not claim a
  concurrent user ioctl path: the card file drain prevents that, and only the
  single remove path sends HPI_ADAPTER_DELETE.

* Suggested direction 

  Free/quiesce the IRQ before `snd_card_free()` and before sending
  HPI_ADAPTER_DELETE:

    if (hpi->irq) {
        free_irq(hpi->irq, hpi);
        hpi->irq = 0;
    }
    snd_card_free(hpi->snd_card);

  Keep the existing `if (pa->irq)` guard in `asihpi_adapter_remove()` to avoid
  a double free.  Alternatively set `card->sync_irq` and perform an explicit
  `synchronize_irq()` before releasing the card private data, but freeing the
  IRQ first is simpler and also covers the `phw` window.



Please keep me in Cc; I am not subscribed to the lists.


Regards,
Hanxiang Xu
xuhx@hust.edu.cn