From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793826888; b=jXpSVr7BibKVLzn+OnDl2XpOb688yMhtnVHg/3jkJoOVR1o7d0e7/QKBHT0QdV6whxj2 Nfl7CwKyXlNsSiX8i3bBYmLa1TGIScBJOlU/jViPxfEzOkFEnphcsD25lvgCJ856fU9c5 1Q1rRP9bApxSx89keK/UlLhRxMBCRpQ6hVLGQPzvZzRJ1bPn0EBarXdUADCcKZn5AIdeW 3ZXKDOyAvHnbioYj7nRIn37l4oIPguZN/0hG1jvne7hFlx0201U1QQdovZXRT+tdEVu4c iniO1qaRh7ltWHAu749qvTE4HueSDIWrvSDsXtNTprfNZlqYw76bfy3e1aU+lvYfljA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793826888; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=DjWiQoIz3qDeBmS+rH/fg8mnE2gELOFWS+DORs3t4GE=; b=n1naWiOXm5M1WsZTUQydG8na7K89t4CPOwP0ke3GFSW5NryYdcbtIlHpxfoh0EyouWKN jrg1DS7N/T7Jj6DKQ5pKmKWpmgTdgzneDyUnRkZKYxzGsbzEAMD7wxl5l/2Kn87JcvVkE CrjwoBYn9Bk73KMtXLxhm2/JnJabJTb0Xe/UZuUNDLzVONuGp1+7kFTgwx3wZfRsMrb0Q ZDwbDg0/wLdE55qh6U7ATXPDpuTLP6/YqKC9628xQj8nr+e68+h/hIH3EXg2gTPVg56Bb vfcZ7GMNAPns5iDZWb9v+iDlLLvUzI2eqOpyC/T9vLDUUQsPQZiN6uqvimeMptwqprA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=s+0uzY5A; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E2086082FDF; Wed, 4 Nov 2026 21:14:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=s+0uzY5A Received: by smtp.kernel.org (Postfix) with ESMTPSA id D76C41F00919; Wed, 4 Nov 2026 21:14:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793826888; bh=DjWiQoIz3qDeBmS+rH/fg8mnE2gELOFWS+DORs3t4GE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=s+0uzY5AKcKJidWW6JwFBAS3Ii54uLevvXbjQ9mFvHOPtORk8Wzum1kieOhDVVJQN SqG17aPUC/LzDKdnEp1PMiTofu+imIeYA9JRP0p39RlHDJunprr8hBqXXxq6eFsYV+ 6fld/N0prNKi8oBa0H2Gr/u33oAYtoDVEBGX9ZQU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Bin Yu , Cheng Wen , YuanZhe Liu <25031212351@stu.xidian.edu.cn>, Takashi Iwai Subject: [PATCH 7.3 067/547] ALSA: line6: Clear prev_fbuf on capture buffer release Date: Wed, 4 Nov 2026 16:04:11 -0500 Message-ID: <20261104211040.172322839@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104211038.406938024@linuxfoundation.org> References: <20261104211038.406938024@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: YuanZhe Liu <25031212351@stu.xidian.edu.cn> commit aa118c8f61d59387961d58ffae831c5259a9f222 upstream. A KASAN slab-use-after-free read was reported in submit_audio_out_urb() when generating an impulse test signal: BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline] BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249 Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785 Allocated by task 11: kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144 line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158 line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329 line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728 Freed by task 7785: kfree+0xf8/0x390 mm/slub.c:6566 line6_buffer_release sound/usb/line6/pcm.c:176 [inline] line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170 __line6_pcm_release sound/usb/line6/pcm.c:305 [inline] line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313 snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183 line6pcm->prev_fbuf points into the capture PCM stream buffer (line6pcm->in.buffer), which is updated during audio_in_callback() to feed rate synchronization, software monitoring, and impulse test signal generation on playback side. When all capture streams are closed, line6_buffer_release() frees pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf. If playback is subsequently started (e.g. via impulse test signal volume control snd_line6_impulse_volume_put()), submit_audio_out_urb() dereferences the stale pointer line6pcm->prev_fbuf under in.lock, resulting in a slab-use-after-free read. Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing the capture stream buffer under in.lock, ensuring that no stale buffer pointer can be accessed by submit_audio_out_urb(). Fixes: 63e20df1e5b2 ("ALSA: line6: Reorganize PCM stream handling") Cc: stable@vger.kernel.org Co-developed-by: Bin Yu Signed-off-by: Bin Yu Co-developed-by: Cheng Wen Signed-off-by: Cheng Wen Signed-off-by: YuanZhe Liu <25031212351@stu.xidian.edu.cn> Link: https://patch.msgid.link/20261013063554.571-1-25031212351@stu.xidian.edu.cn Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/usb/line6/pcm.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/sound/usb/line6/pcm.c +++ b/sound/usb/line6/pcm.c @@ -173,6 +173,14 @@ static void line6_buffer_release(struct clear_bit(type, &pstr->opened); if (!pstr->opened) { line6_wait_clear_audio_urbs(line6pcm, pstr); + if (pstr == &line6pcm->in) { + /* prev_fbuf points into the capture buffer we are about + * to free; drop it while no capture URB is in flight. + */ + guard(spinlock_irqsave)(&line6pcm->in.lock); + line6pcm->prev_fbuf = NULL; + line6pcm->prev_fsize = 0; + } kfree(pstr->buffer); pstr->buffer = NULL; }