• Takashi Iwai's avatar
    ALSA: line6: Fix leftover URB at error-path during probe · c95072b3
    Takashi Iwai authored
    While line6_probe() may kick off URB for a control MIDI endpoint, the
    function doesn't clean up it properly at its error path.  This results
    in a leftover URB action that is eventually triggered later and causes
    an Oops like:
      general protection fault: 0000 [#1] PREEMPT SMP KASAN
      CPU: 1 PID: 0 Comm: swapper/1 Not tainted
      RIP: 0010:usb_fill_bulk_urb ./include/linux/usb.h:1619
      RIP: 0010:line6_start_listen+0x3fe/0x9e0 sound/usb/line6/driver.c:76
      Call Trace:
       <IRQ>
       line6_data_received+0x1f7/0x470 sound/usb/line6/driver.c:326
       __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779
       usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845
       dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965
       call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281
       ....
    
    Since the whole clean-up procedure is done in line6_disconnect()
    callback, we can simply call it in the error path instead of
    open-coding the whole again.  It'll fix such an issue automagically.
    
    The bug was spotted by syzkaller.
    
    Fixes: eedd0e95 ("ALSA: line6: Don't forget to call driver's destructor at error path")
    Reported-by: 's avatarAndrey Konovalov <andreyknvl@google.com>
    Tested-by: 's avatarAndrey Konovalov <andreyknvl@google.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: 's avatarTakashi Iwai <tiwai@suse.de>
    c95072b3
Name
Last commit
Last update
..
6fire Loading commit data...
bcd2000 Loading commit data...
caiaq Loading commit data...
hiface Loading commit data...
line6 Loading commit data...
misc Loading commit data...
usx2y Loading commit data...
Kconfig Loading commit data...
Makefile Loading commit data...
card.c Loading commit data...
card.h Loading commit data...
clock.c Loading commit data...
clock.h Loading commit data...
debug.h Loading commit data...
endpoint.c Loading commit data...
endpoint.h Loading commit data...
format.c Loading commit data...
format.h Loading commit data...
helper.c Loading commit data...
helper.h Loading commit data...
midi.c Loading commit data...
midi.h Loading commit data...
mixer.c Loading commit data...
mixer.h Loading commit data...
mixer_maps.c Loading commit data...
mixer_quirks.c Loading commit data...
mixer_quirks.h Loading commit data...
mixer_scarlett.c Loading commit data...
mixer_scarlett.h Loading commit data...
mixer_us16x08.c Loading commit data...
mixer_us16x08.h Loading commit data...
pcm.c Loading commit data...
pcm.h Loading commit data...
power.h Loading commit data...
proc.c Loading commit data...
proc.h Loading commit data...
quirks-table.h Loading commit data...
quirks.c Loading commit data...
quirks.h Loading commit data...
stream.c Loading commit data...
stream.h Loading commit data...
usbaudio.h Loading commit data...