Skip to content

Commit

Permalink
ALSA: line6: Fix leftover URB at error-path during probe
Browse files Browse the repository at this point in the history
While line6_probe() may kick off URB for a control MIDI endpoint, the
function doesn't clean up it properly at its error path.  This results
in a leftover URB action that is eventually triggered later and causes
an Oops like:
  general protection fault: 0000 [#1] PREEMPT SMP KASAN
  CPU: 1 PID: 0 Comm: swapper/1 Not tainted
  RIP: 0010:usb_fill_bulk_urb ./include/linux/usb.h:1619
  RIP: 0010:line6_start_listen+0x3fe/0x9e0 sound/usb/line6/driver.c:76
  Call Trace:
   <IRQ>
   line6_data_received+0x1f7/0x470 sound/usb/line6/driver.c:326
   __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779
   usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845
   dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965
   call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281
   ....

Since the whole clean-up procedure is done in line6_disconnect()
callback, we can simply call it in the error path instead of
open-coding the whole again.  It'll fix such an issue automagically.

The bug was spotted by syzkaller.

Fixes: eedd0e9 ("ALSA: line6: Don't forget to call driver's destructor at error path")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
tiwai committed Oct 9, 2017
1 parent 54a4b2b commit c95072b
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions sound/usb/line6/driver.c
Original file line number Diff line number Diff line change
Expand Up @@ -779,9 +779,10 @@ int line6_probe(struct usb_interface *interface,
return 0;

error:
if (line6->disconnect)
line6->disconnect(line6);
snd_card_free(card);
/* we can call disconnect callback here because no close-sync is
* needed yet at this point
*/
line6_disconnect(interface);
return ret;
}
EXPORT_SYMBOL_GPL(line6_probe);
Expand Down

0 comments on commit c95072b

Please sign in to comment.