Skip to contentSkip to conversation

ALSA: ump: do not touch legacy_rmidi before it exists

PATCH In review Qingyu Zhang 2 participants 2 messages Sep 2 Sound

lore
Share & tools
lore

Qingyu Zhang

author
#0 lore raw

PATCH 1/1 ALSA: ump: do not touch legacy_rmidi before it exists

snd_ump_parse_endpoint() sets ump->parsed on every exit, including error, before the caller attaches the legacy rawmidi device. ump_handle_ep_name_msg() then treats parsed as "legacy_rmidi is live" and calls ump_legacy_set_rawmidi_name(), which snprintf()s into ump->legacy_rmidi->name. If a UMP packet arrives in that window (IRQ path from snd_ump_receive), legacy_rmidi is still NULL (KASAN null-ptr-deref in snprintf).

Guard the legacy helpers. parsed only means endpoint info was parsed, not that legacy_rmidi exists.

Fixes 37e0e14128e0 ("ALSA: ump: Support UMP Endpoint and Function Block parsing")
Signed-off-by Qingyu Zhang <[email protected]>

---

sound/core/ump.c +4 -0
index d183c8a000bd..3d1a2ed3b476 100644
@@ -1335,6 +1335,8 @@ static void update_legacy_names(struct snd_ump_endpoint *ump)
 {
 	struct snd_rawmidi *rmidi = ump->legacy_rmidi;
 
+	if (!rmidi)
+		return;
 	update_legacy_substreams(ump, rmidi, SNDRV_RAWMIDI_STREAM_INPUT);
 	update_legacy_substreams(ump, rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT);
 }

@@ -1343,6 +1345,8 @@ static void ump_legacy_set_rawmidi_name(struct snd_ump_endpoint *ump)
 {
 	struct snd_rawmidi *rmidi = ump->legacy_rmidi;
 
+	if (!rmidi)
+		return;
 	snprintf(rmidi->name, sizeof(rmidi->name), "%.68s (MIDI 1.0)",
 		 ump->core.name);
 }
#1 lore raw
Quoted 9 lines · Qingyu Zhang

snd_ump_parse_endpoint() sets ump->parsed on every exit, including error, before the caller attaches the legacy rawmidi device. ump_handle_ep_name_msg() then treats parsed as "legacy_rmidi is live" and calls ump_legacy_set_rawmidi_name(), which snprintf()s into ump->legacy_rmidi->name. If a UMP packet arrives in that window (IRQ path from snd_ump_receive), legacy_rmidi is still NULL (KASAN null-ptr-deref in snprintf).

Quoted 5 lines

Guard the legacy helpers. parsed only means endpoint info was parsed, not that legacy_rmidi exists.

Fixes 37e0e14128e0 ("ALSA: ump: Support UMP Endpoint and Function Block parsing")
Signed-off-by Qingyu Zhang <[email protected]>

Applied now. Thanks.

Takashi