Skip to contentSkip to conversation

Patch "ALSA: line6: Fix leftover URB at error-path during probe" has been added to the 4.9-stable tree

PATCH [email protected] 1 participant 1 message Oct 15, 2017

Subsystems (2)
Stable branch Sound
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

ALSA: line6: Fix leftover URB at error-path during probe

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
alsa-line6-fix-leftover-urb-at-error-path-during-probe.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From c95072b3d88fac4be295815f2b67df366c0c297f Mon Sep 17 00:00:00 2001

From: Takashi Iwai <[email protected]>
Date: Mon, 9 Oct 2017 14:51:23 +0200
Subject: ALSA: line6: Fix leftover URB at error-path during probe

From: Takashi Iwai <[email protected]>

commit c95072b3d88fac4be295815f2b67df366c0c297f upstream.

While line6_probe() may kick off URB for a control MIDI endpoint, the function doesn't clean up it properly at its error path. This results in a leftover URB action that is eventually triggered later and causes an Oops like:

  general protection fault: 0000 [#1] PREEMPT SMP KASAN
  CPU: 1 PID: 0 Comm: swapper/1 Not tainted
  RIP: 0010:usb_fill_bulk_urb ./include/linux/usb.h:1619
  RIP: 0010:line6_start_listen+0x3fe/0x9e0 sound/usb/line6/driver.c:76
  Call Trace:
   <IRQ>
   line6_data_received+0x1f7/0x470 sound/usb/line6/driver.c:326
   __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779
   usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845
   dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965
   call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281
   ....

Since the whole clean-up procedure is done in line6_disconnect() callback, we can simply call it in the error path instead of open-coding the whole again. It'll fix such an issue automagically.

The bug was spotted by syzkaller.

Fixes eedd0e95d355 ("ALSA: line6: Don't forget to call driver's destructor at error path")
Reported-by Andrey Konovalov <[email protected]>
Tested-by Andrey Konovalov <[email protected]>
Signed-off-by Takashi Iwai <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 sound/usb/line6/driver.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)
sound/usb/line6/driver.c +4 -3
@@ -775,9 +775,10 @@ int line6_probe(struct usb_interface *in
 	return 0;
 
  error:
-	if (line6->disconnect)
-		line6->disconnect(line6);
-	snd_card_free(card);
+	/* we can call disconnect callback here because no close-sync is
+	 * needed yet at this point
+	 */
+	line6_disconnect(interface);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(line6_probe);

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/alsa-line6-fix-missing-initialization-before-error-path.patch queue-4.9/alsa-caiaq-fix-stray-urb-at-probe-error-path.patch queue-4.9/alsa-seq-fix-copy_from_user-call-inside-lock.patch queue-4.9/alsa-seq-fix-use-after-free-at-creating-a-port.patch queue-4.9/alsa-line6-fix-leftover-urb-at-error-path-during-probe.patch queue-4.9/alsa-usb-audio-kill-stray-urb-at-exiting.patch