[PATCH] ALSA: ump: fix double free of out_cvts on rawmidi error

[PATCH] ALSA: ump: fix double free of out_cvts on rawmidi error

[Baul Lee]

snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array
ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with
kfree() but leaves ump->out_cvts pointing at the freed memory.  When the
endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts
a second time, resulting in a double free.

The host snd-usb-audio driver attaches the legacy rawmidi for any USB
MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail
reaches this path on enumeration.

Clear ump->out_cvts after freeing it on the error path so it is not
freed again during teardown.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Fixes: 33cd7630782d ("ALSA: ump: Export MIDI1 / UMP conversion helpers")
Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
Reported-by: Baul Lee <baul.lee@xbow.com>
Cc: stable@vger.kernel.org
Signed-off-by: Baul Lee <baul.lee@xbow.com>
---
 sound/core/ump.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/core/ump.c b/sound/core/ump.c
index 70520c7ca293..632c13baf21e 100644
--- a/sound/core/ump.c
+++ b/sound/core/ump.c
@@ -1365,6 +1365,7 @@ int snd_ump_attach_legacy_rawmidi(struct snd_ump_endpoint *ump,
 			      &rmidi);
 	if (err < 0) {
 		kfree(ump->out_cvts);
+		ump->out_cvts = NULL;
 		return err;
 	}
 
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] ALSA: ump: fix double free of out_cvts on rawmidi error

[Takashi Iwai]

On Sun, 26 Jul 2026 07:16:33 +0200,
Baul Lee wrote:
> 
> snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array
> ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with
> kfree() but leaves ump->out_cvts pointing at the freed memory.  When the
> endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts
> a second time, resulting in a double free.
> 
> The host snd-usb-audio driver attaches the legacy rawmidi for any USB
> MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail
> reaches this path on enumeration.
> 
> Clear ump->out_cvts after freeing it on the error path so it is not
> freed again during teardown.
> 
> Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
> 
> Fixes: 33cd7630782d ("ALSA: ump: Export MIDI1 / UMP conversion helpers")
> Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
> Reported-by: Baul Lee <baul.lee@xbow.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Baul Lee <baul.lee@xbow.com>

Applied now.  Thanks.


Takashi