From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8B7B1334C39; Mon, 20 Apr 2026 15:46:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776699993; cv=none; b=kTEmQ6tXFdsVMUpN2Ow9MWWZL0y4tOLXP8DdBn2JY7Pa53pH7GLASVNbXGDAUohxhpWo/HaMaGXA38/Re04pAroKI/NPCvavXEj0Th7181nIri8eerE4Tzpu8fOPb8NXrkJsv8OwmKdSuLDSTxnmrf+tS3Hedl/zbxwiLsk0C1Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776699993; c=relaxed/simple; bh=SyIdSQtCi7WwV+6K83HVskOsmPXmO1nxw58ExItWQNo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ey7jKn2NXFoWsCN/8pFTwhDy1nZyuuQzEZPZHp21aarv+ik8ztgb13EU1ypDg0ciQ5ySQNU4yjN0qgOZQWWPZIviksaNcIiMmdn0fFL6T75lEcT6NdXzvf/kTy715k5HqcqvifDm/bKAiEqvLsKLq9iP6SwvpjNkE6mxWZGCKqE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tnniqgn9; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="tnniqgn9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23891C19425; Mon, 20 Apr 2026 15:46:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1776699993; bh=SyIdSQtCi7WwV+6K83HVskOsmPXmO1nxw58ExItWQNo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tnniqgn9gwjWnfZWcudQKYQlGaFjit5COFpxlivAnWSsgazwL3NXE/amKQjBqQR9i o4l4OGGbFjOTNGGrnUTewlu/Gu2FdKjzHmRpeFaC/jK/JvR1pbqHF6cRUeec0XZAXV T7Fq9lEQ2cGkyCo72bvMUcCp8sny4Kr6jQFGjFDY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Andrey Konovalov , Berk Cem Goksel , Takashi Iwai Subject: [PATCH 7.0 69/76] ALSA: 6fire: fix use-after-free on disconnect Date: Mon, 20 Apr 2026 17:42:20 +0200 Message-ID: <20260420153913.329944676@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260420153910.810034134@linuxfoundation.org> References: <20260420153910.810034134@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.0-stable review patch. If anyone has any objections, please let me know. ------------------ From: Berk Cem Goksel commit b9c826916fdce6419b94eb0cd8810fdac18c2386 upstream. In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_card_free_when_closed() is called and no file handles are open, the card and embedded chip are freed synchronously. The subsequent chip->card = NULL write then hits freed slab memory. Call trace: usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline] usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458 ... hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953 Fix by moving the card lifecycle out of usb6fire_chip_abort() and into usb6fire_chip_disconnect(). The card pointer is saved in a local before any teardown, snd_card_disconnect() is called first to prevent new opens, URBs are aborted while chip is still valid, and snd_card_free_when_closed() is called last so chip is never accessed after the card may be freed. Fixes: a0810c3d6dd2 ("ALSA: 6fire: Release resources at card release") Cc: stable@vger.kernel.org Cc: Andrey Konovalov Signed-off-by: Berk Cem Goksel Link: https://patch.msgid.link/20260410051341.1069716-1-berkcgoksel@gmail.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/usb/6fire/chip.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) --- a/sound/usb/6fire/chip.c +++ b/sound/usb/6fire/chip.c @@ -53,11 +53,6 @@ static void usb6fire_chip_abort(struct s usb6fire_comm_abort(chip); if (chip->control) usb6fire_control_abort(chip); - if (chip->card) { - snd_card_disconnect(chip->card); - snd_card_free_when_closed(chip->card); - chip->card = NULL; - } } } @@ -168,6 +163,7 @@ destroy_chip: static void usb6fire_chip_disconnect(struct usb_interface *intf) { struct sfire_chip *chip; + struct snd_card *card; chip = usb_get_intfdata(intf); if (chip) { /* if !chip, fw upload has been performed */ @@ -178,8 +174,19 @@ static void usb6fire_chip_disconnect(str chips[chip->regidx] = NULL; } + /* + * Save card pointer before teardown. + * snd_card_free_when_closed() may free card (and + * the embedded chip) immediately, so it must be + * called last and chip must not be accessed after. + */ + card = chip->card; chip->shutdown = true; + if (card) + snd_card_disconnect(card); usb6fire_chip_abort(chip); + if (card) + snd_card_free_when_closed(card); } } }