[PATCH] ALSA: us122l: Fix NULL dereference at hwdep open and release

[PATCH] ALSA: us122l: Fix NULL dereference at hwdep open and release

[YuanZhe Liu]

usb_stream_hwdep_open() and usb_stream_hwdep_release() pass the result of
usb_ifnum_to_if() straight to usb_autopm_get_interface() and
usb_autopm_put_interface(), without checking it for NULL.

usb_ifnum_to_if() returns NULL once the device is gone, since
usb_disable_device() clears udev->actconfig on disconnect.  The hwdep file
can outlive the disconnect: the card is released with
snd_card_free_when_closed(), so a process that keeps the character device
open reaches the driver's release callback after the USB configuration has
been dropped, and interface_to_usbdev() then dereferences the NULL
interface at offsetof(struct device, parent).  The open callback has the
same problem when it races with the disconnect.

Check both lookups and fail the open with -ENODEV; in release, skip the
runtime PM put when the interface is already gone and still run the rest
of the per-file cleanup.  Move the us122l->first bookkeeping after the
checks so that a failed open no longer leaves a stale file pointer behind.

Fixes: 030a07e44129 ("ALSA: Add USB US122L driver")
Cc: stable@vger.kernel.org
Co-developed-by: Bin Yu <byu@xidian.edu.cn>
Signed-off-by: Bin Yu <byu@xidian.edu.cn>
Co-developed-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: YuanZhe Liu <25031212351@stu.xidian.edu.cn>
---
 sound/usb/usx2y/us122l.c | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index a5db0d044ef9..d93e3240b1b0 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -129,19 +129,26 @@ static const struct vm_operations_struct usb_stream_hwdep_vm_ops = {
 static int usb_stream_hwdep_open(struct snd_hwdep *hw, struct file *file)
 {
 	struct us122l	*us122l = hw->private_data;
-	struct usb_interface *iface;
+	struct usb_interface *iface, *iface0 = NULL;
 
 	if (hw->used >= 2)
 		return -EBUSY;
 
-	if (!us122l->first)
-		us122l->first = file;
-
 	if (us122l->is_us144) {
-		iface = usb_ifnum_to_if(us122l->dev, 0);
-		usb_autopm_get_interface(iface);
+		iface0 = usb_ifnum_to_if(us122l->dev, 0);
+		if (!iface0)
+			return -ENODEV;
 	}
+
 	iface = usb_ifnum_to_if(us122l->dev, 1);
+	if (!iface)
+		return -ENODEV;
+
+	if (!us122l->first)
+		us122l->first = file;
+
+	if (iface0)
+		usb_autopm_get_interface(iface0);
 	usb_autopm_get_interface(iface);
 	return 0;
 }
@@ -153,10 +160,12 @@ static int usb_stream_hwdep_release(struct snd_hwdep *hw, struct file *file)
 
 	if (us122l->is_us144) {
 		iface = usb_ifnum_to_if(us122l->dev, 0);
-		usb_autopm_put_interface(iface);
+		if (iface)
+			usb_autopm_put_interface(iface);
 	}
 	iface = usb_ifnum_to_if(us122l->dev, 1);
-	usb_autopm_put_interface(iface);
+	if (iface)
+		usb_autopm_put_interface(iface);
 	if (us122l->first == file)
 		us122l->first = NULL;
 	guard(mutex)(&us122l->mutex);
-- 
2.34.1

Re: [PATCH] ALSA: us122l: Fix NULL dereference at hwdep open and release

[YuanZhe Liu]

Hi Takashi,

Could you please review this patch?

  [PATCH] ALSA: us122l: Fix NULL dereference at hwdep open and release

It checks for a missing USB interface in us122l hwdep open and release,
avoiding a NULL dereference in the runtime-PM calls.

The patch is unchanged. I am copying this address for visibility.

Original submission:
https://lore.kernel.org/r/20261028074143.14440-1-25031212351@stu.xidian.edu.cn

Thanks,
YuanZhe

Re: [PATCH] ALSA: us122l: Fix NULL dereference at hwdep open and release

[Takashi Iwai]

On Wed, 28 Oct 2026 08:41:43 +0100,
YuanZhe Liu wrote:
> 
> usb_stream_hwdep_open() and usb_stream_hwdep_release() pass the result of
> usb_ifnum_to_if() straight to usb_autopm_get_interface() and
> usb_autopm_put_interface(), without checking it for NULL.
> 
> usb_ifnum_to_if() returns NULL once the device is gone, since
> usb_disable_device() clears udev->actconfig on disconnect.  The hwdep file
> can outlive the disconnect: the card is released with
> snd_card_free_when_closed(), so a process that keeps the character device
> open reaches the driver's release callback after the USB configuration has
> been dropped, and interface_to_usbdev() then dereferences the NULL
> interface at offsetof(struct device, parent).  The open callback has the
> same problem when it races with the disconnect.
> 
> Check both lookups and fail the open with -ENODEV; in release, skip the
> runtime PM put when the interface is already gone and still run the rest
> of the per-file cleanup.  Move the us122l->first bookkeeping after the
> checks so that a failed open no longer leaves a stale file pointer behind.
> 
> Fixes: 030a07e44129 ("ALSA: Add USB US122L driver")
> Cc: stable@vger.kernel.org
> Co-developed-by: Bin Yu <byu@xidian.edu.cn>
> Signed-off-by: Bin Yu <byu@xidian.edu.cn>
> Co-developed-by: Cheng Wen <wencheng@xidian.edu.cn>
> Signed-off-by: Cheng Wen <wencheng@xidian.edu.cn>
> Signed-off-by: YuanZhe Liu <25031212351@stu.xidian.edu.cn>

Applied now.  Thanks.


Takashi