From: Takashi Iwai <tiwai@suse.de>
To: Yuanzhe Liu <25031212351@stu.xidian.edu.cn>
Cc: Takashi Iwai <tiwai@suse.com>, Jaroslav Kysela <perex@perex.cz>,
linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org, Bin Yu <byu@xidian.edu.cn>,
Cheng Wen <wencheng@xidian.edu.cn>
Subject: Re: [PATCH] ALSA: line6: Clear prev_fbuf on capture buffer release
Date: Tue, 13 Oct 2026 09:08:52 +0200 [thread overview]
Message-ID: <87bj8yoz5n.wl-tiwai@suse.de> (raw)
In-Reply-To: <20261013063554.571-1-25031212351@stu.xidian.edu.cn>
On Tue, 13 Oct 2026 08:35:54 +0200,
Yuanzhe Liu wrote:
>
> From: YuanZhe Liu <25031212351@stu.xidian.edu.cn>
>
> A KASAN slab-use-after-free read was reported in submit_audio_out_urb()
> when generating an impulse test signal:
>
> BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]
> BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249
> Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785
>
> Allocated by task 11:
> kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144
> line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158
> line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329
> line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728
>
> Freed by task 7785:
> kfree+0xf8/0x390 mm/slub.c:6566
> line6_buffer_release sound/usb/line6/pcm.c:176 [inline]
> line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170
> __line6_pcm_release sound/usb/line6/pcm.c:305 [inline]
> line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313
> snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183
>
> line6pcm->prev_fbuf points into the capture PCM stream buffer
> (line6pcm->in.buffer), which is updated during audio_in_callback() to
> feed rate synchronization, software monitoring, and impulse test signal
> generation on playback side.
>
> When all capture streams are closed, line6_buffer_release() frees
> pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf.
> If playback is subsequently started (e.g. via impulse test signal
> volume control snd_line6_impulse_volume_put()), submit_audio_out_urb()
> dereferences the stale pointer line6pcm->prev_fbuf under in.lock,
> resulting in a slab-use-after-free read.
>
> Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing
> the capture stream buffer under in.lock, ensuring that no stale buffer
> pointer can be accessed by submit_audio_out_urb().
>
> Fixes: 63e20df1e5b2 ("ALSA: line6: Reorganize PCM stream handling")
> Cc: stable@vger.kernel.org
> Co-developed-by: Bin Yu <byu@xidian.edu.cn>
> Signed-off-by: Bin Yu <byu@xidian.edu.cn>
> Co-developed-by: Cheng Wen <wencheng@xidian.edu.cn>
> Signed-off-by: Cheng Wen <wencheng@xidian.edu.cn>
> Signed-off-by: YuanZhe Liu <25031212351@stu.xidian.edu.cn>
Applied to for-next branch. Thanks.
Takashi
prev parent reply other threads:[~2026-10-13 7:08 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-13 6:35 [PATCH] ALSA: line6: Clear prev_fbuf on capture buffer release Yuanzhe Liu
2026-10-13 7:08 ` Takashi Iwai [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87bj8yoz5n.wl-tiwai@suse.de \
--to=tiwai@suse.de \
--cc=25031212351@stu.xidian.edu.cn \
--cc=byu@xidian.edu.cn \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=perex@perex.cz \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.com \
--cc=wencheng@xidian.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.