[PATCH v3] ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd

[PATCH v3] ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd

[Haein Lee]

In snd_usb_create_streams(), for UAC version 3 devices, the Interface
Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this
call fails, a fallback routine attempts to obtain the IAD from the next
interface and sets a BADD profile. However, snd_usb_mixer_controls_badd()
assumes that the IAD retrieved from usb_ifnum_to_if() is always valid,
without performing a NULL check. This can lead to a NULL pointer
dereference when usb_ifnum_to_if() fails to find the interface descriptor.

This patch adds a NULL pointer check after calling usb_ifnum_to_if() in
snd_usb_mixer_controls_badd() to prevent the dereference.

This issue was discovered by syzkaller, which triggered the bug by sending
a crafted USB device descriptor.

Signed-off-by: Haein Lee <lhi0729@kaist.ac.kr>
---
 sound/usb/mixer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 6f00e0d52382..72b900505d2c 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -3086,6 +3086,8 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer,
 	int i;
 
 	assoc = usb_ifnum_to_if(dev, ctrlif)->intf_assoc;
+	if (!assoc)
+		return -EINVAL;
 
 	/* Detect BADD capture/playback channels from AS EP descriptors */
 	for (i = 0; i < assoc->bInterfaceCount; i++) {
-- 
2.34.1

Re: [PATCH v3] ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd

[Takashi Iwai]

On Tue, 11 Nov 2025 16:37:54 +0100,
Haein Lee wrote:
> 
> In snd_usb_create_streams(), for UAC version 3 devices, the Interface
> Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this
> call fails, a fallback routine attempts to obtain the IAD from the next
> interface and sets a BADD profile. However, snd_usb_mixer_controls_badd()
> assumes that the IAD retrieved from usb_ifnum_to_if() is always valid,
> without performing a NULL check. This can lead to a NULL pointer
> dereference when usb_ifnum_to_if() fails to find the interface descriptor.
> 
> This patch adds a NULL pointer check after calling usb_ifnum_to_if() in
> snd_usb_mixer_controls_badd() to prevent the dereference.
> 
> This issue was discovered by syzkaller, which triggered the bug by sending
> a crafted USB device descriptor.
> 
> Signed-off-by: Haein Lee <lhi0729@kaist.ac.kr>

Applied now.  Thanks.


Takashi