Re: [PATCH] ALSA: ump: Fix double-free of ump->out_cvts on legacy rawmidi attach failure

[Takashi Iwai]

On Wed, 29 Jul 2026 02:23:33 +0200,
Deepanshu Kartikey wrote:
> 
> If snd_rawmidi_new() fails inside snd_ump_attach_legacy_rawmidi(), the
> error path frees ump->out_cvts but leaves the pointer dangling. Since
> ump->out_cvts is a field of the long-lived struct snd_ump_endpoint
> (not the rawmidi device that failed to be created), it gets freed a
> second time later during normal endpoint teardown, in
> snd_ump_endpoint_free(), invoked via snd_rawmidi_free()'s
> private_free callback when the sound card is released. This results
> in a KASAN double-free/invalid-free.
> 
> Clear ump->out_cvts to NULL after freeing it on the error path, so
> the later unconditional kfree() in snd_ump_endpoint_free() becomes a
> harmless no-op.
> 
> Reported-by: syzbot+b6cab840e6a85641c7ad@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=b6cab840e6a85641c7ad
> Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>

The very same fix has been already merged in commit
70c977815af0d997feb2d0c5d284d55689bf7051 on sound git tree.


thanks,

Takashi