Re: [PATCH] ALSA: us122l: Fix NULL dereference at hwdep open and release

[Takashi Iwai]

On Wed, 28 Oct 2026 08:41:43 +0100,
YuanZhe Liu wrote:
> 
> usb_stream_hwdep_open() and usb_stream_hwdep_release() pass the result of
> usb_ifnum_to_if() straight to usb_autopm_get_interface() and
> usb_autopm_put_interface(), without checking it for NULL.
> 
> usb_ifnum_to_if() returns NULL once the device is gone, since
> usb_disable_device() clears udev->actconfig on disconnect.  The hwdep file
> can outlive the disconnect: the card is released with
> snd_card_free_when_closed(), so a process that keeps the character device
> open reaches the driver's release callback after the USB configuration has
> been dropped, and interface_to_usbdev() then dereferences the NULL
> interface at offsetof(struct device, parent).  The open callback has the
> same problem when it races with the disconnect.
> 
> Check both lookups and fail the open with -ENODEV; in release, skip the
> runtime PM put when the interface is already gone and still run the rest
> of the per-file cleanup.  Move the us122l->first bookkeeping after the
> checks so that a failed open no longer leaves a stale file pointer behind.
> 
> Fixes: 030a07e44129 ("ALSA: Add USB US122L driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Co-developed-by: Bin Yu <byu@xxxxxxxxxxxxx>
> Signed-off-by: Bin Yu <byu@xxxxxxxxxxxxx>
> Co-developed-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
> Signed-off-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
> Signed-off-by: YuanZhe Liu <25031212351@xxxxxxxxxxxxxxxxx>

Applied now.  Thanks.


Takashi