Re: [PATCH 1/2] ALSA: caiaq: fix use-after-free and double-free in setup_card()

[Takashi Iwai]

On Fri, 10 Apr 2026 06:59:03 +0200,
Berk Cem Goksel wrote:
> 
> When snd_card_register() fails in setup_card(), snd_card_free() is
> called on the card, but there is no return statement afterwards.
> Execution falls through to snd_usb_caiaq_control_init(cdev), which
> dereferences members of the just-freed card, resulting in a
> use-after-free.
> 
> setup_card() is void and init_card() still returns 0 on this path,
> so snd_probe() leaves the freed card pointer in the USB interface's
> private data via usb_set_intfdata(). When the device is later
> disconnected, snd_usb_caiaq_disconnect() calls
> snd_card_free_when_closed() on that same pointer, producing a
> double-free and slab corruption.
> 
> Add the missing return so a failed snd_card_register() cleanly
> aborts setup without touching freed memory.
> 
> The issue is reachable by any caiaq-compatible USB device whose
> descriptors cause snd_card_register() to fail. It was reproduced
> with raw-gadget + dummy_hcd on 7.0.0-rc5 (arm64, KASAN).
> 
> Fixes: 523f1dce7096 ("ALSA: snd-usb-caiaq: add support for NI Audio Kontrol 1")
> Cc: stable@xxxxxxxxxxxxxxx
> Cc: Andrey Konovalov <andreyknvl@xxxxxxxxx>
> Signed-off-by: Berk Cem Goksel <berkcgoksel@xxxxxxxxx>

The code fix itself looks fine, but the Fixes tag above points to a
non-existing commit.  What tree are you using?


thanks,

Takashi


> ---
>  sound/usb/caiaq/device.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
> --- a/sound/usb/caiaq/device.c
> +++ b/sound/usb/caiaq/device.c
> @@ -369,6 +369,7 @@
>  	if (ret < 0) {
>  		dev_err(dev, "snd_card_register() returned %d\n", ret);
>  		snd_card_free(cdev->chip.card);
> +		return;
>  	}
> 
>  	ret = snd_usb_caiaq_control_init(cdev);