Re: [PATCH] ALSA: usb-audio: fix list_add double-add in push_back_to_ready_list

[Takashi Iwai <tiwai@suse.de>]

On Tue, 15 Sep 2026 18:31:10 +0200,
Nguyen Ngoc Thang wrote:
> 
> stop_urbs() clears ep->ready_playback_urbs with a bare INIT_LIST_HEAD()
> instead of unlinking each queued snd_urb_ctx. If a URB survives past
> wait_clear_urbs()'s forced STOPPING->STOPPED timeout, its ctx is left
> looking "linked" (stale next/prev) even though the list head has
> forgotten it. When the endpoint later restarts and re-queues that same
> ctx onto the (now real) ready list, and the old URB's completion
> handler then calls push_back_to_ready_list() for it a second time, the
> ctx is still the list's own tail and list_add's double-add check trips:
> 
>   kernel BUG at lib/list_debug.c:35 (list_add double add)
> 
> Guard push_back_to_ready_list() with a list_empty() check so a
> still-linked ctx isn't re-added, and make stop_urbs() actually unlink
> each ctx via list_del_init() instead of only resetting the head, so a
> dropped ctx doesn't keep looking linked to that guard.
> 
> Reported-by: syzbot+9fe3b8d9f5c64ff410a7@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=9fe3b8d9f5c64ff410a7
> Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
> ---
> Note: I was not able to trigger the actual crash. dummy_hcd doesn't
> expose isochronous endpoints by default; after patching that locally
> for testing, 1600 PREPARE/START/DRAIN cycles plus a
> WARN_ON(!list_empty(&ctx->ready_list)) probe in push_back_to_ready_list()
> never hit the race window (wait_clear_urbs() never logged a "timeout:
> still N active urbs", so the forced STOPPING->STOPPED path was never
> even exercised in this setup). This fix is based on static analysis of
> the reported stack trace and the stop_urbs()/wait_clear_urbs()/
> push_back_to_ready_list() interaction, not a confirmed repro. Sharing
> in case someone with real hardware or a working reproducer can verify.

Applied now.  Thanks.


Takashi