Re: [PATCH] ALSA: us122l: Add missing NULL check in usb_stream_hwdep_mmap()

[Takashi Iwai]

On Wed, 28 Oct 2026 05:25:25 +0100,
YuanZhe Liu wrote:
> 
> usb_stream_hwdep_mmap() reads us122l->sk.s and dereferences it without
> checking for NULL.  The stream object is released by usb_stream_free(),
> which is reached through us122l_stop() both when the device is
> disconnected and when us122l_start() fails, and it leaves us122l->sk.s
> set to NULL.  The hwdep file stays usable after that, so a later mmap()
> 
> 	KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> 	RIP: 0010:usb_stream_hwdep_mmap+0x107/0x890 sound/usb/usx2y/us122l.c:182
> 
> crashes while reading s->read_size, which sits at offset 0x10.
> 
> That NULL is an expected state for this field: usb_stream_hwdep_vm_fault(),
> usb_stream_hwdep_poll(), usb_stream_hwdep_ioctl(), usb_stream_stop() and
> usb_stream_free() all test it before use.  Only the mmap callback misses
> the check, so let it return -ENODEV, matching what the other hwdep mapping
> in usx2yhwdeppcm.c does when its shared buffer has not been allocated.
> 
> Fixes: 030a07e441296c372f946cd4065b5d831d8dc40c ("ALSA: Add USB US122L driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Co-developed-by: Bin Yu <byu@xxxxxxxxxxxxx>
> Signed-off-by: Bin Yu <byu@xxxxxxxxxxxxx>
> Co-developed-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
> Signed-off-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
> Signed-off-by: YuanZhe Liu <25031212351@xxxxxxxxxxxxxxxxx>

Applied now.  Thanks.

(I've been traveling in the last few days, sorry for the delay.)


Takashi