[PATCH] ALSA: us122l: Add missing NULL check in usb_stream_hwdep_mmap()

[PATCH] ALSA: us122l: Add missing NULL check in usb_stream_hwdep_mmap()

[YuanZhe Liu]

usb_stream_hwdep_mmap() reads us122l->sk.s and dereferences it without
checking for NULL.  The stream object is released by usb_stream_free(),
which is reached through us122l_stop() both when the device is
disconnected and when us122l_start() fails, and it leaves us122l->sk.s
set to NULL.  The hwdep file stays usable after that, so a later mmap()

	KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
	RIP: 0010:usb_stream_hwdep_mmap+0x107/0x890 sound/usb/usx2y/us122l.c:182

crashes while reading s->read_size, which sits at offset 0x10.

That NULL is an expected state for this field: usb_stream_hwdep_vm_fault(),
usb_stream_hwdep_poll(), usb_stream_hwdep_ioctl(), usb_stream_stop() and
usb_stream_free() all test it before use.  Only the mmap callback misses
the check, so let it return -ENODEV, matching what the other hwdep mapping
in usx2yhwdeppcm.c does when its shared buffer has not been allocated.

Fixes: 030a07e441296c372f946cd4065b5d831d8dc40c ("ALSA: Add USB US122L driver")
Cc: stable@vger.kernel.org
Co-developed-by: Bin Yu <byu@xidian.edu.cn>
Signed-off-by: Bin Yu <byu@xidian.edu.cn>
Co-developed-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: YuanZhe Liu <25031212351@stu.xidian.edu.cn>
---
 sound/usb/usx2y/us122l.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index a5db0d044ef9..27b6b0bd5768 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -179,6 +179,8 @@ static int usb_stream_hwdep_mmap(struct snd_hwdep *hw,
 	offset = area->vm_pgoff << PAGE_SHIFT;
 	guard(mutex)(&us122l->mutex);
 	s = us122l->sk.s;
+	if (!s)
+		return -ENODEV;
 	read = offset < s->read_size;
 	if (read) {
 		if (area->vm_flags & VM_WRITE)
-- 
2.34.1

Re: [PATCH] ALSA: us122l: Add missing NULL check in usb_stream_hwdep_mmap()

[YuanZhe Liu]

Hi Takashi,

Could you please review this patch?

  [PATCH] ALSA: us122l: Add missing NULL check in
  usb_stream_hwdep_mmap()

It checks for a missing stream object in usb_stream_hwdep_mmap() and
returns ENODEV instead of dereferencing NULL.

The patch is unchanged. I am copying this address for visibility.

Original submission:
https://lore.kernel.org/r/20261028042525.8737-1-25031212351@stu.xidian.edu.cn

Thanks,
YuanZhe

Re: [PATCH] ALSA: us122l: Add missing NULL check in usb_stream_hwdep_mmap()

[Takashi Iwai]

On Wed, 28 Oct 2026 05:25:25 +0100,
YuanZhe Liu wrote:
> 
> usb_stream_hwdep_mmap() reads us122l->sk.s and dereferences it without
> checking for NULL.  The stream object is released by usb_stream_free(),
> which is reached through us122l_stop() both when the device is
> disconnected and when us122l_start() fails, and it leaves us122l->sk.s
> set to NULL.  The hwdep file stays usable after that, so a later mmap()
> 
> 	KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> 	RIP: 0010:usb_stream_hwdep_mmap+0x107/0x890 sound/usb/usx2y/us122l.c:182
> 
> crashes while reading s->read_size, which sits at offset 0x10.
> 
> That NULL is an expected state for this field: usb_stream_hwdep_vm_fault(),
> usb_stream_hwdep_poll(), usb_stream_hwdep_ioctl(), usb_stream_stop() and
> usb_stream_free() all test it before use.  Only the mmap callback misses
> the check, so let it return -ENODEV, matching what the other hwdep mapping
> in usx2yhwdeppcm.c does when its shared buffer has not been allocated.
> 
> Fixes: 030a07e441296c372f946cd4065b5d831d8dc40c ("ALSA: Add USB US122L driver")
> Cc: stable@vger.kernel.org
> Co-developed-by: Bin Yu <byu@xidian.edu.cn>
> Signed-off-by: Bin Yu <byu@xidian.edu.cn>
> Co-developed-by: Cheng Wen <wencheng@xidian.edu.cn>
> Signed-off-by: Cheng Wen <wencheng@xidian.edu.cn>
> Signed-off-by: YuanZhe Liu <25031212351@stu.xidian.edu.cn>

Applied now.  Thanks.

(I've been traveling in the last few days, sorry for the delay.)


Takashi