Re: [PATCH v3] ALSA: bcd2000: Fix use-after-free of MIDI URBs on file close

[Takashi Iwai]

On Sat, 31 Oct 2026 20:09:36 +0100,
YuanZhe Liu wrote:
> 
> bcd2000_disconnect() calls snd_card_disconnect(), which only prevents
> new opens, and then frees the MIDI URBs.  A rawmidi file that was
> already open can still be closed afterwards, and its close callback,
> bcd2000_midi_output_close(), calls usb_kill_urb() on midi_out_urb.
> 
> The URB pointers are cleared on disconnect and their accesses are
> serialized with midi_lock, but bcd2000_midi_output_close() reads
> midi_out_urb without that lock.  The check can therefore pass just
> before the pointer is cleared, and usb_kill_urb() then runs on the URB
> that has already been freed:
> 
>   BUG: KASAN: slab-use-after-free in usb_kill_urb+0x74/0x80
>   Read of size 8 at addr ffff8880078e7d40
>    usb_kill_urb
>    bcd2000_midi_output_close
>    close_substream
>    rawmidi_release_priv
>    snd_rawmidi_release
> 
>   Allocated by: usb_alloc_urb <- bcd2000_init_midi <- bcd2000_probe
>   Freed by:     usb_free_urb <- bcd2000_midi_free
>                 <- bcd2000_disconnect
> 
> Take the lock in bcd2000_midi_output_close() and reference the URB with
> usb_get_urb() before releasing it.  The URB then stays valid until
> usb_put_urb() after usb_kill_urb() has returned, even if a disconnect
> frees it in the meantime.  usb_kill_urb() itself cannot run under
> midi_lock, as the completion handler takes the same lock.
> 
> Fixes: b47a22290d58 ("ALSA: MIDI driver for Behringer BCD2000 USB device")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: YuanZhe Liu <25031212351@xxxxxxxxxxxxxxxxx>

Applied now.  Thanks.


Takashi