From: Vasileios Almpanis <vasilisalmpanis@gmail.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Andrzej Pietrasiewicz <andrzej.p@samsung.com>,
Felipe Balbi <balbi@ti.com>
Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
syzbot+df868600fe111c5ff79f@syzkaller.appspotmail.com,
Vasileios Almpanis <vasilisalmpanis@gmail.com>
Subject: [PATCH] usb: gadget: f_uac1_legacy: fix double close of the ALSA devices
Date: Fri, 31 Jul 2026 20:26:45 +0200 [thread overview]
Message-ID: <20260731-alsa-v1-1-95eb93ba32ec@gmail.com> (raw)
f_audio_bind() records that the ALSA files are open in the function
instance flag opts->bound, but keeps the file pointers in the
per-function gaudio card. Its error path calls gaudio_cleanup(), which
closes the files without clearing the filp pointers or opts->bound.
A failed bind does not destroy the usb_function, configfs_composite_bind()
puts it back on cfg->func_list, so the next write to UDC binds the same
f_audio, skips gaudio_setup() because opts->bound is still set, and on
failure closes the files a second time. Dropping the config symlink after
a failed bind closes them again via f_audio_free().
BUG: KASAN: slab-use-after-free in filp_flush+0x31/0x190 fs/open.c:1464
Read of size 8 at addr ffff888045f01990 by task syz-executor659/5617
Call Trace:
filp_close+0x1d/0x40 fs/open.c:1484
gaudio_close_snd_dev drivers/usb/gadget/function/u_uac1_legacy.c:263 [inline]
gaudio_cleanup+0x54/0xf0 drivers/usb/gadget/function/u_uac1_legacy.c:305
f_audio_bind+0x4a0/0x630 drivers/usb/gadget/function/f_uac1_legacy.c:792
usb_add_function+0x290/0x930 drivers/usb/gadget/composite.c:333
configfs_composite_bind+0xde0/0x1410 drivers/usb/gadget/configfs.c:1802
gadget_bind_driver+0x2ca/0x9e0 drivers/usb/gadget/udc/core.c:1662
gadget_dev_desc_UDC_store+0x1c9/0x2f0 drivers/usb/gadget/configfs.c:300
Clear filp, substream and card in gaudio_close_snd_dev() so cleanup is
idempotent, and close the devices on the bind error path only if that
bind opened them, resetting opts->bound as well.
Fixes: f3a3406b3f56 ("usb: gadget: f_uac1: convert to new function interface with backward compatibility")
Reported-by: syzbot+df868600fe111c5ff79f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=df868600fe111c5ff79f
Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com>
---
drivers/usb/gadget/function/f_uac1_legacy.c | 8 +++++++-
drivers/usb/gadget/function/u_uac1_legacy.c | 17 ++++++++++++++---
2 files changed, 21 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/function/f_uac1_legacy.c b/drivers/usb/gadget/function/f_uac1_legacy.c
index 5d201a2e30e7f19c56c372c9112eb888781bb90d..02774faebdbbc07a3fce0ef1fa47136d34b961ea 100644
--- a/drivers/usb/gadget/function/f_uac1_legacy.c
+++ b/drivers/usb/gadget/function/f_uac1_legacy.c
@@ -732,6 +732,7 @@ f_audio_bind(struct usb_configuration *c, struct usb_function *f)
int status;
struct usb_ep *ep = NULL;
struct f_uac1_legacy_opts *audio_opts;
+ bool bound_here = false;
audio_opts = container_of(f->fi, struct f_uac1_legacy_opts, func_inst);
audio->card.gadget = c->cdev->gadget;
@@ -741,6 +742,7 @@ f_audio_bind(struct usb_configuration *c, struct usb_function *f)
if (status < 0)
return status;
audio_opts->bound = true;
+ bound_here = true;
}
us = usb_gstrings_attach(cdev, uac1_strings, ARRAY_SIZE(strings_uac1));
if (IS_ERR(us))
@@ -789,7 +791,11 @@ f_audio_bind(struct usb_configuration *c, struct usb_function *f)
return 0;
fail:
- gaudio_cleanup(&audio->card);
+ /* Only tear down the ALSA devices if this bind opened them; the */
+ if (bound_here) {
+ gaudio_cleanup(&audio->card);
+ audio_opts->bound = false;
+ }
return status;
}
diff --git a/drivers/usb/gadget/function/u_uac1_legacy.c b/drivers/usb/gadget/function/u_uac1_legacy.c
index 01016102fa1728f8bcc92a3ed66b29a318cd52f4..c2b6c88b0bdc9994da027854ec107934c8e814c4 100644
--- a/drivers/usb/gadget/function/u_uac1_legacy.c
+++ b/drivers/usb/gadget/function/u_uac1_legacy.c
@@ -259,18 +259,29 @@ static int gaudio_close_snd_dev(struct gaudio *gau)
/* Close control device */
snd = &gau->control;
- if (snd->filp)
+ if (snd->filp) {
filp_close(snd->filp, NULL);
+ snd->filp = NULL;
+ snd->card = NULL;
+ }
/* Close PCM playback device and setup substream */
snd = &gau->playback;
- if (snd->filp)
+ if (snd->filp) {
filp_close(snd->filp, NULL);
+ snd->filp = NULL;
+ snd->substream = NULL;
+ snd->card = NULL;
+ }
/* Close PCM capture device and setup substream */
snd = &gau->capture;
- if (snd->filp)
+ if (snd->filp) {
filp_close(snd->filp, NULL);
+ snd->filp = NULL;
+ snd->substream = NULL;
+ snd->card = NULL;
+ }
return 0;
}
---
base-commit: 8ba098e6b6ff0db8edf28528d1552be261af30d4
change-id: 20260731-alsa-656c9f27b141
Best regards,
--
Vasileios Almpanis <vasilisalmpanis@gmail.com>
reply other threads:[~2026-07-31 18:26 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260731-alsa-v1-1-95eb93ba32ec@gmail.com \
--to=vasilisalmpanis@gmail.com \
--cc=andrzej.p@samsung.com \
--cc=balbi@ti.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=syzbot+df868600fe111c5ff79f@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.