Re: [PATCH] ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd

[Takashi Iwai]

On Tue, 11 Nov 2025 13:35:13 +0100,
Haein Lee wrote:
> 
> 
> In snd_usb_create_streams(), for UAC version 3 devices, the Interface
> Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this
> call fails, a fallback routine attempts to obtain the IAD from the next
> interface and sets a BADD profile. However, snd_usb_mixer_controls_badd()
> assumes the IAD retrieved from usb_ifnum_to_if() is always valid without
> performing a NULL check. This can lead to a NULL pointer dereference when
> usb_ifnum_to_if() fails to find the interface descriptor.
> 
> This patch adds a NULL pointer check after calling usb_ifnum_to_if() in
> snd_usb_mixer_controls_badd() to prevent the dereference.

Practically seen, this won't happen because the NULL intf_assoc is
already checked at snd_usb_create_streams() as a fatal error before
reaching this point.  But it would be still safer to have a sanity
check here, too.

In anyway, the patch seems to have a bad format that can't be
applied.  Tabs and spaces seem corrupted by your mailer.

Could you resubmit with a proper format (and add the information I
mentioned in the above)?


thanks,

Takashi

> ---
>  sound/usb/mixer.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
> index 6f00e0d52382..72b900505d2c 100644
> --- a/sound/usb/mixer.c
> +++ b/sound/usb/mixer.c
> @@ -3086,6 +3086,8 @@ static int snd_usb_mixer_controls_badd(struct
> usb_mixer_interface *mixer,
>      int i;
>  
>      assoc = usb_ifnum_to_if(dev, ctrlif)->intf_assoc;
> +    if (!assoc)
> +        return -EINVAL;
>  
>      /* Detect BADD capture/playback channels from AS EP descriptors */
>      for (i = 0; i < assoc->bInterfaceCount; i++) {
> -- 
> 2.34.1
> 
> [mail-r]
>