[PATCH] ALSA: usb-audio: scarlett2: unwind notify URB init failures

[PATCH] ALSA: usb-audio: scarlett2: unwind notify URB init failures

[Yousef Alhouseen]

scarlett2_init_notify() stores the newly allocated URB in mixer->urb
before allocating the transfer buffer and submitting the URB. If a later
step fails, the function returns an error while leaving a partially
initialized notification URB attached to the mixer.

Clean up the URB and transfer buffer locally on those failure paths.
Leave mixer->urb NULL so later cleanup or retry paths do not see a
stale notification URB.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
---
 sound/usb/mixer_scarlett2.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
index 78fb72e626ca..67a089ad7723 100644
--- a/sound/usb/mixer_scarlett2.c
+++ b/sound/usb/mixer_scarlett2.c
@@ -8729,6 +8729,7 @@ static int scarlett2_init_notify(struct usb_mixer_interface *mixer)
 	struct scarlett2_data *private = mixer->private_data;
 	unsigned int pipe = usb_rcvintpipe(dev, private->bEndpointAddress);
 	void *transfer_buffer;
+	int err;
 
 	if (mixer->urb) {
 		usb_audio_err(mixer->chip,
@@ -8744,8 +8745,11 @@ static int scarlett2_init_notify(struct usb_mixer_interface *mixer)
 		return -ENOMEM;
 
 	transfer_buffer = kmalloc(private->wMaxPacketSize, GFP_KERNEL);
-	if (!transfer_buffer)
+	if (!transfer_buffer) {
+		usb_free_urb(mixer->urb);
+		mixer->urb = NULL;
 		return -ENOMEM;
+	}
 
 	usb_fill_int_urb(mixer->urb, dev, pipe,
 			 transfer_buffer, private->wMaxPacketSize,
@@ -8753,7 +8757,17 @@ static int scarlett2_init_notify(struct usb_mixer_interface *mixer)
 
 	init_completion(&private->cmd_done);
 
-	return usb_submit_urb(mixer->urb, GFP_KERNEL);
+	err = usb_submit_urb(mixer->urb, GFP_KERNEL);
+	if (err) {
+		usb_audio_err(mixer->chip,
+			      "%s: usb_submit_urb failed: %d\n",
+			      __func__, err);
+		kfree(transfer_buffer);
+		usb_free_urb(mixer->urb);
+		mixer->urb = NULL;
+	}
+
+	return err;
 }
 
 /* Cargo cult proprietary initialisation sequence */
-- 
2.54.0

Re: [PATCH] ALSA: usb-audio: scarlett2: unwind notify URB init failures

[Takashi Iwai]

On Mon, 29 Jun 2026 18:02:32 +0200,
Yousef Alhouseen wrote:
> 
> scarlett2_init_notify() stores the newly allocated URB in mixer->urb
> before allocating the transfer buffer and submitting the URB. If a later
> step fails, the function returns an error while leaving a partially
> initialized notification URB attached to the mixer.
> 
> Clean up the URB and transfer buffer locally on those failure paths.
> Leave mixer->urb NULL so later cleanup or retry paths do not see a
> stale notification URB.

Those are released by the common snd_usb_mixer_free() in the error
path of snd_usb_create_mixer(), hence no need to do here.


thanks,

Takashi

Re: [PATCH] ALSA: usb-audio: scarlett2: unwind notify URB init failures

[Yousef Alhouseen]

Thanks, Takashi. I missed the common cleanup in snd_usb_mixer_free().
Please drop this patch.

On Tue, 30 Jun 2026 14:23:43 +0200, Takashi Iwai <tiwai@suse.de> wrote:
> On Mon, 29 Jun 2026 18:02:32 +0200,
> Yousef Alhouseen wrote:
> >
> > scarlett2_init_notify() stores the newly allocated URB in mixer->urb
> > before allocating the transfer buffer and submitting the URB. If a later
> > step fails, the function returns an error while leaving a partially
> > initialized notification URB attached to the mixer.
> >
> > Clean up the URB and transfer buffer locally on those failure paths.
> > Leave mixer->urb NULL so later cleanup or retry paths do not see a
> > stale notification URB.
>
> Those are released by the common snd_usb_mixer_free() in the error
> path of snd_usb_create_mixer(), hence no need to do here.
>
> thanks,
>
> Takashi