Re: [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

[Edward Adam Davis]

From: Edward Aadm Davis <eadavis@xxxxxxxx>

On Thu, 03 Sep 2026 11:32:22 +0200, Takashi Iwai wrote:
> > The epq_in_urb object belonging to the caiaq device is coupled within
> > the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
> > executes successfully, epq_in_urb is successfully added to the urbp_list
> > queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
> > layer driver for the caiaq USB device).
> >
> > When init_card() calls snd_usb_caiaq_send_command() which subsequently
> > fails due to a timeout, and proceeds to call snd_card_free() to release
> > the card, the embedded ep1_in_urb object is also freed. When the dummy
> > HCD driver detects that the URB has been unlinked, it returns the URB
> > (by usb_hcd_giveback_urb()), which triggers [1].
> >
> > Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
> > to using a pointer instead. Separately allocate and manage the memory for
> > ep1_in_urb to prevent the release of the snd_card memory object from
> > interfering with it.
> >
> > [1]
> > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> > Call Trace:
> >  usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> >  dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
> >  __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
> >  __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
> >  hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
> >
> > Allocated by task 36:
> >  snd_card_new+0x7b/0x110 sound/core/init.c:184
> >  create_card sound/usb/caiaq/device.c:429 [inline]
> >  snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
> >
> > Freed by task 36:
> >  snd_card_free_when_closed sound/core/init.c:630 [inline]
> >  snd_card_free+0x138/0x1d0 sound/core/init.c:662
> >  snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
> >
> > Reported-by: syzbot+832ce9fa3face1b7d44d@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
> > Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> > Tested-by: syzbot+832ce9fa3face1b7d44d@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Signed-off-by: Edward Adam Davis <eadavis@xxxxxxxx>
> > ---
> >  sound/usb/caiaq/device.c | 19 +++++++++++--------
> >  sound/usb/caiaq/device.h |  2 +-
> >  2 files changed, 12 insertions(+), 9 deletions(-)
> >
> > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
> > index a16e59248480..138b58914f1c 100644
> > --- a/sound/usb/caiaq/device.c
> > +++ b/sound/usb/caiaq/device.c
> > @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
> >  		break;
> >  	}
> >
> > -	cdev->ep1_in_urb.actual_length = 0;
> > -	ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
> > +	cdev->ep1_in_urb->actual_length = 0;
> > +	ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
> >  	if (ret < 0)
> >  		dev_err(dev, "unable to submit urb. OOM!?\n");
> >  }
> > @@ -408,6 +408,8 @@ static void card_free(struct snd_card *card)
> >  #endif
> >  	snd_usb_caiaq_audio_free(cdev);
> >  	usb_put_dev(cdev->chip.dev);
> > +	usb_free_urb(cdev->ep1_in_urb);
> > +	cdev->ep1_in_urb = NULL;
> >  }
> >
> >  static int create_card(struct usb_device *usb_dev,
> > @@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
> >  		return -EIO;
> >  	}
> >
> > -	usb_init_urb(&cdev->ep1_in_urb);
> > +	cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
> > +	usb_init_urb(cdev->ep1_in_urb);
> 
> The error check is missing here, as sashiko review pointed out.
> Could you fix and resubmit?
OK. I will fix and resubmit.
> 
> (The other issues reported there -- the potential-double-free and the
> midi_out_urb handling can be skipped here; I'll fix those
> individually.)
I can handle `midi_out_urb` as well.

BR,
Edward