• File: sys/dev/sound/pci/emu10kx-pcm.c
• Lines: 1453, 1488, 1497, 1511
• Severity: Low
• CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U:C:L/I:L/A:H
• CWE: CWE-416 Use After Free
• Confidence: certain

Summary

emu_pcm_attach() registers an interrupt consumer with the parent emu10kx driver at line 1453 (sc->ihandle = emu_intr_register(...)) but neither the bad: cleanup label nor emu_pcm_detach() ever calls emu_intr_unregister().

After kfree(sc) at line 1493 (attach-failure path) or line 1513 (detach path), the parent's ihandler[] array still holds a live pointer to the freed sc and the parent's IRQ dispatcher (emu10kx.c:996) has no liveness check; the next interval-timer IRQ (which fires continuously once the card is active) dispatches emu_pcm_intr() against the freed memory, where snd_mtxlock(sc->lock) (emu10kx-pcm.c:1237) dereferences a dangling pointer — typically panicking the kernel and, with slab grooming, plausibly exploitable for kernel code execution.

Root cause

At sys/dev/sound/pci/emu10kx-pcm.c:1453 the driver registers itself as an IRQ consumer of the parent:

sc->ihandle = emu_intr_register(sc->card,
    EMU_INTE_INTERTIMERENB, EMU_IPR_INTERVALTIMER, &emu_pcm_intr, sc);

The bad: cleanup label (lines 1488–1494) only destroys sc->codec and sc->lock and kfrees sc — it never calls emu_intr_unregister.

emu_pcm_detach() (lines 1497–1516) likewise only calls pcm_unregister(), the no-op emu_pcm_uninit(), snd_mtxfree(sc->lock) and kfree(sc) — no emu_intr_unregister.

The parent driver stores the softc pointer raw (struct emu_intr_handler { void *softc; ... }, emu10kx.c:300-305) and dispatches IRQs by direct call sc->ihandler[i].irq_func(sc->ihandler[i].softc, ...) at emu10kx.c:996 with no reference counting or liveness check.

The sibling driver sys/dev/sound/pci/emu10kx-midi.c correctly unregisters in BOTH the attach error path (line 203) AND in detach (line 230) — confirming this is a genuine omission in emu10kx-pcm.c rather than an intended design.

Note also emu_intr_unregister() itself does not validate its hnumber argument before using it as an array index (emu10kx.c:956), so a correct fix in this file must guard the call with an explicit sentinel check.

Threat

Triggered by:

1. Any failure of pcm_register() after line 1453 during device attach — e.g. kernel malloc failure inside the PCM framework under memory pressure — leaving the IRQ handler registered while sc is freed at line 1493; or
2. kldunload snd_emu10kx_pcm as root while the parent emu10kx remains loaded and the EMU10Kx hardware is generating IRQs (the EMU_INTE_INTERTIMERENB source remains enabled because it is OR'd into the parent's EMU_INTE at register time, emu10kx.c:932-934); or
3. Any hotplug/device-removal path that detaches the pcm child.

Once sc is freed, the next IRQ dispatches into emu_pcm_intr with a dangling softc; snd_mtxlock(sc->lock) at emu10kx-pcm.c:1237 then operates on reclaimed memory.

Typical impact: immediate kernel panic (DoS). With sizeof(struct emu_pcm_info) being a small slab-friendly size, an attacker who can groom the slab can replace the freed allocation with controlled data so that sc->lock points to attacker-controlled memory, turning lockmgr's dereference into a primitive.

Primary trigger requires root (kldunload) or hardware access; the attach-failure path can occur during normal boot under memory pressure.

Exploit / PoC

Reproduction on a DragonFlyBSD system with an EMU10K1/EMU10K2 (Sound Blaster Live!/Audigy) card present — root required for the cleanest trigger:

1. kldload snd_emu10kx && kldload snd_emu10kx_pcm — attaches the parent and the pcm child; emu_pcm_attach registers the IRQ consumer at emu10kx-pcm.c:1453.
2. Start audio DMA so interval-timer IRQs are firing: cat /dev/zero > /dev/dsp0 & sleep 1 (or play any sample). The parent's EMU_INTE_INTERTIMERENB is now armed.
3. kldunload snd_emu10kx_pcm — invokes emu_pcm_detach (emu10kx-pcm.c:1497) which kfrees sc at line 1513 WITHOUT calling emu_intr_unregister; the parent's ihandler[] entry still points at the freed sc.
4. Within one IRQ interval (sub-millisecond), the parent's emu_intr() loop at emu10kx.c:993-998 dispatches emu_pcm_intr(freed_sc, ...) which executes snd_mtxlock(sc->lock) at emu10kx-pcm.c:1237 against reclaimed memory.

Success criterion: kernel panic immediately after kldunload (within ~1ms), with a backtrace rooted at emu_pcm_intr → lockmgr/snd_mtxlock, typically panic: ... from a deref of a corrupted lock pointer in the freed/reused slab object.

For the privilege-escalation chain: after step 3, race-spray allocations of size sizeof(struct emu_pcm_info) (a few hundred bytes — easily computed from the struct definition at lines 90–112) to reclaim the freed slab slot with controlled bytes such that the sc->lock field (first field of struct emu_pcm_info) collides with a pointer the attacker controls; the subsequent snd_mtxlock becomes a write to an attacker-chosen kernel address.

Full chain depends on slab layout and is hardware/state-specific, so the conservative, reproducible impact is DoS-via-panic.

Recommended fix

Mirror the sibling emu10kx-midi.c cleanup pattern: initialize sc->ihandle to a sentinel (-1, since slot 0 is a valid return value from emu_intr_register) immediately after kmalloc, and call emu_intr_unregister in both the bad: path and emu_pcm_detach before kfree. Use >= 0 rather than relying on emu_intr_unregister's bounds checking because that function itself indexes ihandler[hnumber] without validating hnumber (emu10kx.c:956).

--- a/sys/dev/sound/pci/emu10kx-pcm.c
+++ b/sys/dev/sound/pci/emu10kx-pcm.c
@@ -1346,6 +1346,7 @@ emu_pcm_attach(device_t dev)

    sc = kmalloc(sizeof(*sc), M_DEVBUF, M_WAITOK | M_ZERO);
+   sc->ihandle = -1;   /* sentinel: not yet registered with parent IRQ */
    sc->card = (struct emu_sc_info *)(device_get_softc(device_get_parent(dev)));
    if (sc->card == NULL) {
        device_printf(dev, "cannot get bridge conf\n");
@@ -1487,6 +1488,9 @@ emu_pcm_attach(device_t dev)

 bad:
+   if (sc->ihandle >= 0)
+       emu_intr_unregister(sc->card, sc->ihandle);
    if (sc->codec)
        ac97_destroy(sc->codec);
    if (sc->lock)
        snd_mtxfree(sc->lock);
    kfree(sc, M_DEVBUF);
    return (ENXIO);
 }

 static int
 emu_pcm_detach(device_t dev)
@@ -1508,6 +1512,9 @@ emu_pcm_detach(device_t dev)

    emu_pcm_uninit(sc);

+   if (sc->ihandle >= 0)
+       emu_intr_unregister(sc->card, sc->ihandle);
+
    if (sc->lock)
        snd_mtxfree(sc->lock);
    kfree(sc, M_DEVBUF);