general protection fault in snd_scarlett2_init
Subsystems (3)
syzbot
syzbotHello,
syzbot found the following issue on:
HEAD commit: bb375c251ab4 dt-bindings: usb: st,st-ohci-300x: convert to.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing console output: https://syzkaller.appspot.com/x/log.txt?x=138f1b5a580000 kernel config: https://syzkaller.appspot.com/x/.config?x=f1500201919951cc dashboard link: https://syzkaller.appspot.com/bug?extid=ae893a8901067fde2741 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14ffb006580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12ebbb5a580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2475c3172471/disk-bb375c25.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/30449aa672dd/vmlinux-bb375c25.xz
kernel image: https://storage.googleapis.com/syzbot-assets/46d3937d1c16/bzImage-bb375c25.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
usb 4-1: 0:6 : does not exist
usb 4-1: 0:7 : does not exist
usb 4-1: 0:8 : does not exist
usb 4-1: 0:9 : does not exist
usb 4-1: 0:10 : does not exist
usb 4-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8215); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 28 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_endpoint_num include/uapi/linux/usb/ch9.h:479 [inline] RIP: 0010:scarlett2_find_fc_interface sound/usb/mixer_scarlett2.c:8261 [inline] RIP: 0010:scarlett2_init_private sound/usb/mixer_scarlett2.c:8295 [inline] RIP: 0010:snd_scarlett2_controls_create sound/usb/mixer_scarlett2.c:8684 [inline] RIP: 0010:snd_scarlett2_init.cold+0xbad/0x6c79 sound/usb/mixer_scarlett2.c:9407 Code: 84 c0 74 06 0f 8e ca 0b 00 00 48 8b 44 24 20 48 8d 7b 02 48 89 fa 40 88 a8 48 02 00 00 b8 ff ff 37 00 48 c1 ea 03 48 c1 e0 2a <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 9e 0b 00 00 RSP: 0018:ffffc900001e68d8 EFLAGS: 00010286 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81543c4b RDX: 0000000000000000 RSI: ffffffff81543c5d RDI: 0000000000000002 RBP: 0000000000000001 R08: 0000000000000001 R09: 00000000000000ff R10: 00000000000000ff R11: 0000000000000000 R12: ffff88811dd24804 R13: dffffc0000000000 R14: ffff88811dd248a8 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8882687d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000558c34efbe88 CR3: 00000000094ae000 CR4: 00000000003506f0 Call Trace: <TASK> snd_usb_mixer_apply_create_quirk+0x1c21/0x2b80 sound/usb/mixer_quirks.c:4446 snd_usb_create_mixer+0x7a2/0x1910 sound/usb/mixer.c:3641 usb_audio_probe+0xf6d/0x3a90 sound/usb/card.c:1033 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:583 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:661 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:803 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:833 __device_attach_driver+0x1ff/0x3e0 drivers/base/dd.c:961 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1033 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x64/0x160 drivers/base/bus.c:574 device_add+0x11d9/0x1950 drivers/base/core.c:3689 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2208 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:583 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:661 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:803 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:833 __device_attach_driver+0x1ff/0x3e0 drivers/base/dd.c:961 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1033 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x64/0x160 drivers/base/bus.c:574 device_add+0x11d9/0x1950 drivers/base/core.c:3689 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3439 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:usb_endpoint_num include/uapi/linux/usb/ch9.h:479 [inline] RIP: 0010:scarlett2_find_fc_interface sound/usb/mixer_scarlett2.c:8261 [inline] RIP: 0010:scarlett2_init_private sound/usb/mixer_scarlett2.c:8295 [inline] RIP: 0010:snd_scarlett2_controls_create sound/usb/mixer_scarlett2.c:8684 [inline] RIP: 0010:snd_scarlett2_init.cold+0xbad/0x6c79 sound/usb/mixer_scarlett2.c:9407 Code: 84 c0 74 06 0f 8e ca 0b 00 00 48 8b 44 24 20 48 8d 7b 02 48 89 fa 40 88 a8 48 02 00 00 b8 ff ff 37 00 48 c1 ea 03 48 c1 e0 2a <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 9e 0b 00 00 RSP: 0018:ffffc900001e68d8 EFLAGS: 00010286
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81543c4b RDX: 0000000000000000 RSI: ffffffff81543c5d RDI: 0000000000000002 RBP: 0000000000000001 R08: 0000000000000001 R09: 00000000000000ff R10: 00000000000000ff R11: 0000000000000000 R12: ffff88811dd24804 R13: dffffc0000000000 R14: ffff88811dd248a8 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8882687d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4cb1355900 CR3: 00000001175e2000 CR4: 00000000003506f0 ---------------- Code disassembly (best guess): 0: 84 c0 test %al,%al 2: 74 06 je 0xa 4: 0f 8e ca 0b 00 00 jle 0xbd4 a: 48 8b 44 24 20 mov 0x20(%rsp),%rax f: 48 8d 7b 02 lea 0x2(%rbx),%rdi 13: 48 89 fa mov %rdi,%rdx 16: 40 88 a8 48 02 00 00 mov %bpl,0x248(%rax) 1d: b8 ff ff 37 00 mov $0x37ffff,%eax 22: 48 c1 ea 03 shr $0x3,%rdx 26: 48 c1 e0 2a shl $0x2a,%rax * 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction 2e: 48 89 fa mov %rdi,%rdx 31: 83 e2 07 and $0x7,%edx 34: 38 d0 cmp %dl,%al 36: 7f 08 jg 0x40 38: 84 c0 test %al,%al 3a: 0f 85 9e 0b 00 00 jne 0xbde
---
This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
#syz test
sound/usb/mixer.c +5 -1
@@ -3563,8 +3563,12 @@ static int snd_usb_mixer_status_create(struct usb_mixer_interface *mixer)int buffer_length;unsigned int epnum; + epnum =get_iface_desc (mixer->hostif)->bNumEndpoints; +if (epnum ==0 ) +return -EINVAL ; +/* we need one interrupt input endpoint */ -if (get_iface_desc (mixer->hostif)->bNumEndpoints <1 ) +if (epnum <1 )return 0 ; ep =get_endpoint (mixer->hostif,0 );if (!usb_endpoint_dir_in (ep) || !usb_endpoint_xfer_int (ep))
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Tested on:
commit: bb375c25 dt-bindings: usb: st,st-ohci-300x: convert to.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing console output: https://syzkaller.appspot.com/x/log.txt?x=179baa02580000 kernel config: https://syzkaller.appspot.com/x/.config?x=f1500201919951cc dashboard link: https://syzkaller.appspot.com/bug?extid=ae893a8901067fde2741 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=100978d6580000
Note: testing is done by a robot and is best-effort only.
PATCH 1/1 ALSA: usb-audio: Add the number of endpoints checked was 0
In reply to syzbotThe user constructed a corrupted USB device, causing the USB device enumeration phase to fail to resolve any endpoints. This resulted in a null pointer dereference reported in [1] when the USB sound card driver executed probe to initialize the mixer.
To avoid the problem reported in [1], a check was added to ensure that the number of endpoints contained in the interface was 0 when checking the mixer status.
[1]
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:usb_endpoint_num include/uapi/linux/usb/ch9.h:479 [inline] RIP: 0010:scarlett2_find_fc_interface sound/usb/mixer_scarlett2.c:8261 [inline] RIP: 0010:scarlett2_init_private sound/usb/mixer_scarlett2.c:8295 [inline] RIP: 0010:snd_scarlett2_controls_create sound/usb/mixer_scarlett2.c:8684 [inline] RIP: 0010:snd_scarlett2_init.cold+0xbad/0x6c79 sound/usb/mixer_scarlett2.c:9407 Call Trace: snd_usb_mixer_apply_create_quirk+0x1c21/0x2b80 sound/usb/mixer_quirks.c:4446 snd_usb_create_mixer+0x7a2/0x1910 sound/usb/mixer.c:3641 usb_audio_probe+0xf6d/0x3a90 sound/usb/card.c:1033
--- sound/usb/mixer.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/usb/mixer.c +5 -1
@@ -3563,8 +3563,12 @@ static int snd_usb_mixer_status_create(struct usb_mixer_interface *mixer)int buffer_length;unsigned int epnum; + epnum =get_iface_desc (mixer->hostif)->bNumEndpoints; +if (epnum ==0 ) +return -EINVAL ; +/* we need one interrupt input endpoint */ -if (get_iface_desc (mixer->hostif)->bNumEndpoints <1 ) +if (epnum <1 )return 0 ; ep =get_endpoint (mixer->hostif,0 );if (!usb_endpoint_dir_in (ep) || !usb_endpoint_xfer_int (ep))
Signature · 1 line
2.43.0
Re: [PATCH] ALSA: usb-audio: Add the number of endpoints checked was 0
Quoted 36 lines · Edward Adam Davis
The user constructed a corrupted USB device, causing the USB device enumeration phase to fail to resolve any endpoints. This resulted in a null pointer dereference reported in [1] when the USB sound card driver executed probe to initialize the mixer.
To avoid the problem reported in [1], a check was added to ensure that the number of endpoints contained in the interface was 0 when checking the mixer status.
[1]
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:usb_endpoint_num include/uapi/linux/usb/ch9.h:479 [inline] RIP: 0010:scarlett2_find_fc_interface sound/usb/mixer_scarlett2.c:8261 [inline] RIP: 0010:scarlett2_init_private sound/usb/mixer_scarlett2.c:8295 [inline] RIP: 0010:snd_scarlett2_controls_create sound/usb/mixer_scarlett2.c:8684 [inline] RIP: 0010:snd_scarlett2_init.cold+0xbad/0x6c79 sound/usb/mixer_scarlett2.c:9407 Call Trace: snd_usb_mixer_apply_create_quirk+0x1c21/0x2b80 sound/usb/mixer_quirks.c:4446 snd_usb_create_mixer+0x7a2/0x1910 sound/usb/mixer.c:3641 usb_audio_probe+0xf6d/0x3a90 sound/usb/card.c:1033Reported-by [email protected]Tested-by [email protected]Signed-off-by Edward Adam Davis <[email protected]>--- sound/usb/mixer.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)sound/usb/mixer.c +0
-0@@ -3563,8 +3563,12 @@ static int snd_usb_mixer_status_create(struct usb_mixer_interface *mixer)int buffer_length;
sound/usb/mixer.c static int snd_usb_mixer_status_create(struct usb_mixer_interface *mixer) · line 3572
Quoted 10 lines
sound/usb/mixer.c +5
-1unsigned int epnum; + epnum =get_iface_desc (mixer->hostif)->bNumEndpoints; +if (epnum ==0 ) +return -EINVAL ; +/* we need one interrupt input endpoint */ -if (get_iface_desc (mixer->hostif)->bNumEndpoints <1 ) +if (epnum <1 )return 0 ;
The change looks wrong. We don't want to return an error here, as mixer->urb is optional. And the second check introduced above is utterly nonsense; epnum is an unsigned int, so epnum < 1 means only epnum == 0.
The problem is rather in the scarlett2 side, and it should have a check there, not in the core function.
thanks,
Takashi
PATCH v2 1/1 ALSA: scarlett2: Add the number of endpoints checked was 0
The user constructed a corrupted USB device, causing the USB device enumeration phase to fail to resolve any endpoints. This resulted in a null pointer dereference reported in [1] when the USB sound card driver executed probe to initialize the mixer.
To avoid the problem reported in [1], a check was added to ensure that the number of endpoints contained in the interface was 0 when creating mixer controls for the Focusrite Scarlett 2nd/3rd Gen USB sound card.
[1]
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:usb_endpoint_num include/uapi/linux/usb/ch9.h:479 [inline] RIP: 0010:scarlett2_find_fc_interface sound/usb/mixer_scarlett2.c:8261 [inline] RIP: 0010:scarlett2_init_private sound/usb/mixer_scarlett2.c:8295 [inline] RIP: 0010:snd_scarlett2_controls_create sound/usb/mixer_scarlett2.c:8684 [inline] RIP: 0010:snd_scarlett2_init.cold+0xbad/0x6c79 sound/usb/mixer_scarlett2.c:9407 Call Trace: snd_usb_mixer_apply_create_quirk+0x1c21/0x2b80 sound/usb/mixer_quirks.c:4446 snd_usb_create_mixer+0x7a2/0x1910 sound/usb/mixer.c:3641 usb_audio_probe+0xf6d/0x3a90 sound/usb/card.c:1033
---
v1 -> v2: move the check to scarlett2
sound/usb/mixer_scarlett2.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/usb/mixer_scarlett2.c +9 -0
@@ -9393,6 +9393,15 @@ int snd_scarlett2_init(struct usb_mixer_interface *mixer)return 0 ; } +if (get_iface_desc (mixer->hostif)->bNumEndpoints ==0 ) { +usb_audio_err (chip, +"%s: There are no endpoints for %04x:%04x\n" , + __func__, +USB_ID_VENDOR (chip->usb_id), +USB_ID_PRODUCT (chip->usb_id)); +return 0 ; + } +usb_audio_info (chip,"Focusrite %s Mixer Driver enabled (pid=0x%04x); " "report any issues to "
Signature · 1 line
2.43.0
Re: [PATCH v2] ALSA: scarlett2: Add the number of endpoints checked was 0
Quoted 36 lines · Edward Adam Davis
The user constructed a corrupted USB device, causing the USB device enumeration phase to fail to resolve any endpoints. This resulted in a null pointer dereference reported in [1] when the USB sound card driver executed probe to initialize the mixer.
To avoid the problem reported in [1], a check was added to ensure that the number of endpoints contained in the interface was 0 when creating mixer controls for the Focusrite Scarlett 2nd/3rd Gen USB sound card.
[1]
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:usb_endpoint_num include/uapi/linux/usb/ch9.h:479 [inline] RIP: 0010:scarlett2_find_fc_interface sound/usb/mixer_scarlett2.c:8261 [inline] RIP: 0010:scarlett2_init_private sound/usb/mixer_scarlett2.c:8295 [inline] RIP: 0010:snd_scarlett2_controls_create sound/usb/mixer_scarlett2.c:8684 [inline] RIP: 0010:snd_scarlett2_init.cold+0xbad/0x6c79 sound/usb/mixer_scarlett2.c:9407 Call Trace: snd_usb_mixer_apply_create_quirk+0x1c21/0x2b80 sound/usb/mixer_quirks.c:4446 snd_usb_create_mixer+0x7a2/0x1910 sound/usb/mixer.c:3641 usb_audio_probe+0xf6d/0x3a90 sound/usb/card.c:1033Reported-by [email protected]Signed-off-by Edward Adam Davis <[email protected]>---
v1 -> v2: move the check to scarlett2sound/usb/mixer_scarlett2.c | 9 +++++++++ 1 file changed, 9 insertions(+)sound/usb/mixer_scarlett2.c +0
-0
sound/usb/mixer_scarlett2.c int snd_scarlett2_init(struct usb_mixer_interface *mixer) · line 9402
Quoted 10 lines
sound/usb/mixer_scarlett2.c +7
-0@@ -9393,6 +9393,15 @@ int snd_scarlett2_init(struct usb_mixer_interface *mixer)return 0 ; } +if (get_iface_desc (mixer->hostif)->bNumEndpoints ==0 ) { +usb_audio_err (chip, +"%s: There are no endpoints for %04x:%04x\n" , + __func__, +USB_ID_VENDOR (chip->usb_id), +USB_ID_PRODUCT (chip->usb_id)); +return 0 ;
This should be an error. It's obviously a broken descriptor, and this is the code specific to the certain configuration.
Takashi
Re: [PATCH v2] ALSA: scarlett2: Add the number of endpoints checked was 0
Quoted 42 lines · Takashi Iwai
Quoted 39 lines · Edward Adam Davis
The user constructed a corrupted USB device, causing the USB device enumeration phase to fail to resolve any endpoints. This resulted in a null pointer dereference reported in [1] when the USB sound card driver executed probe to initialize the mixer.
To avoid the problem reported in [1], a check was added to ensure that the number of endpoints contained in the interface was 0 when creating mixer controls for the Focusrite Scarlett 2nd/3rd Gen USB sound card.
[1]
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:usb_endpoint_num include/uapi/linux/usb/ch9.h:479 [inline] RIP: 0010:scarlett2_find_fc_interface sound/usb/mixer_scarlett2.c:8261 [inline] RIP: 0010:scarlett2_init_private sound/usb/mixer_scarlett2.c:8295 [inline] RIP: 0010:snd_scarlett2_controls_create sound/usb/mixer_scarlett2.c:8684 [inline] RIP: 0010:snd_scarlett2_init.cold+0xbad/0x6c79 sound/usb/mixer_scarlett2.c:9407 Call Trace: snd_usb_mixer_apply_create_quirk+0x1c21/0x2b80 sound/usb/mixer_quirks.c:4446 snd_usb_create_mixer+0x7a2/0x1910 sound/usb/mixer.c:3641 usb_audio_probe+0xf6d/0x3a90 sound/usb/card.c:1033Reported-by [email protected]Signed-off-by Edward Adam Davis <[email protected]>---
v1 -> v2: move the check to scarlett2sound/usb/mixer_scarlett2.c | 9 +++++++++ 1 file changed, 9 insertions(+)sound/usb/mixer_scarlett2.c +0
-0@@ -9393,6 +9393,15 @@ int snd_scarlett2_init(struct usb_mixer_interface *mixer)return 0 ; }
Quoted 10 lines
sound/usb/mixer_scarlett2.c int snd_scarlett2_init(struct usb_mixer_interface *mixer) · line 9402
Quoted 7 lines
sound/usb/mixer_scarlett2.c +7
-0+if (get_iface_desc (mixer->hostif)->bNumEndpoints ==0 ) { +usb_audio_err (chip, +"%s: There are no endpoints for %04x:%04x\n" , + __func__, +USB_ID_VENDOR (chip->usb_id), +USB_ID_PRODUCT (chip->usb_id)); +return 0 ;This should be an error. It's obviously a broken descriptor, and this is the code specific to the certain configuration.
... and that check alone doesn't cover all cases, I'm afraid. The scarlett2 driver code parses over multiple interfaces.
I guess rather a patch like below should cover better.
thanks,
Takashi
sound/usb/mixer_scarlett2.c +2 -0
@@ -8251,6 +8251,8 @@ static int scarlett2_find_fc_interface(struct usb_device *dev,if (desc->bInterfaceClass !=255 )continue ; +if (desc->bNumEndpoints <1 ) +continue ; epd =get_endpoint (intf->altsetting,0 ); private->bInterfaceNumber = desc->bInterfaceNumber;
Greg KH
maintainerRe: [PATCH v2] ALSA: scarlett2: Add the number of endpoints checked was 0
In reply to Edward Adam DavisQuoted 36 lines · Edward Adam Davis
The user constructed a corrupted USB device, causing the USB device enumeration phase to fail to resolve any endpoints. This resulted in a null pointer dereference reported in [1] when the USB sound card driver executed probe to initialize the mixer.
To avoid the problem reported in [1], a check was added to ensure that the number of endpoints contained in the interface was 0 when creating mixer controls for the Focusrite Scarlett 2nd/3rd Gen USB sound card.
[1]
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:usb_endpoint_num include/uapi/linux/usb/ch9.h:479 [inline] RIP: 0010:scarlett2_find_fc_interface sound/usb/mixer_scarlett2.c:8261 [inline] RIP: 0010:scarlett2_init_private sound/usb/mixer_scarlett2.c:8295 [inline] RIP: 0010:snd_scarlett2_controls_create sound/usb/mixer_scarlett2.c:8684 [inline] RIP: 0010:snd_scarlett2_init.cold+0xbad/0x6c79 sound/usb/mixer_scarlett2.c:9407 Call Trace: snd_usb_mixer_apply_create_quirk+0x1c21/0x2b80 sound/usb/mixer_quirks.c:4446 snd_usb_create_mixer+0x7a2/0x1910 sound/usb/mixer.c:3641 usb_audio_probe+0xf6d/0x3a90 sound/usb/card.c:1033Reported-by [email protected]Signed-off-by Edward Adam Davis <[email protected]>---
v1 -> v2: move the check to scarlett2sound/usb/mixer_scarlett2.c | 9 +++++++++ 1 file changed, 9 insertions(+)sound/usb/mixer_scarlett2.c +0
-0@@ -9393,6 +9393,15 @@ int snd_scarlett2_init(struct usb_mixer_interface *mixer)return 0 ;
sound/usb/mixer_scarlett2.c int snd_scarlett2_init(struct usb_mixer_interface *mixer) · line 9403
Quoted 10 lines
sound/usb/mixer_scarlett2.c +8
-0} +if (get_iface_desc (mixer->hostif)->bNumEndpoints ==0 ) { +usb_audio_err (chip, +"%s: There are no endpoints for %04x:%04x\n" , + __func__, +USB_ID_VENDOR (chip->usb_id), +USB_ID_PRODUCT (chip->usb_id)); +return 0 ; + }
Why not use the "normal" functions to check a USB device for the exact specific types and numbers of endpoints instead of hand-coding it all?
thanks,
greg k-h