es_pci_attach error path after mixer_init leaves a live /dev/mixerN pointing at freed codec/es (UAF on open/ioctl)
Summary
es_pci_attach calls mixer_init BEFORE the IRQ allocation, DMA tag creation and pcm_register - any of which can still fail. mixer_init make_dev's a 0666 /dev/mixerN holding si_drv1 -> the codec/es; the bad: path frees the codec and es but never mixer_uninit (failed attach gets no detach). The orphaned node then dereferences freed memory on open/ioctl. Attach-failure precondition only - hardening-grade. Same family as DF-4156 (maestro). Move-mixer_init fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4193 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 198 B | ↓ raw | |
| verdict.json | file | 1.0 KB | view raw |
DF-4193 — es137x attach-error dangling /dev/mixerN UAF
mixer_init before IRQ/dma/pcm_register; bad: frees codec/es without mixer teardown. Attach-failure gated; family of DF-4156. PoC skipped.
Fix verification
not_testablemove mixer_init after pcm_register (as most pcm drivers do) or mixer_uninit on the bad: path before freeing codec/es
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
es137x.c:1816/1829 mixer_init make_dev vs bad: 1879-1894 frees codec/es without mixer teardown; mixer.c:730-733
Verdict
source-verified; attach-failure-gated
No comments yet.