[PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

[PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

[Edward Adam Davis]

The epq_in_urb object belonging to the caiaq device is coupled within
the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
executes successfully, epq_in_urb is successfully added to the urbp_list
queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
layer driver for the caiaq USB device).

When init_card() calls snd_usb_caiaq_send_command() which subsequently
fails due to a timeout, and proceeds to call snd_card_free() to release
the card, the embedded ep1_in_urb object is also freed. When the dummy
HCD driver detects that the URB has been unlinked, it returns the URB
(by usb_hcd_giveback_urb()), which triggers [1].

Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
to using a pointer instead. Separately allocate and manage the memory for
ep1_in_urb to prevent the release of the snd_card memory object from
interfering with it.

[1]
BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
Call Trace:
 usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
 dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
 __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
 hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141

Allocated by task 36:
 snd_card_new+0x7b/0x110 sound/core/init.c:184
 create_card sound/usb/caiaq/device.c:429 [inline]
 snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544

Freed by task 36:
 snd_card_free_when_closed sound/core/init.c:630 [inline]
 snd_card_free+0x138/0x1d0 sound/core/init.c:662
 snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
 
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
 sound/usb/caiaq/device.c | 19 +++++++++++--------
 sound/usb/caiaq/device.h |  2 +-
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index a16e59248480..138b58914f1c 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
 		break;
 	}
 
-	cdev->ep1_in_urb.actual_length = 0;
-	ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
+	cdev->ep1_in_urb->actual_length = 0;
+	ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
 	if (ret < 0)
 		dev_err(dev, "unable to submit urb. OOM!?\n");
 }
@@ -408,6 +408,8 @@ static void card_free(struct snd_card *card)
 #endif
 	snd_usb_caiaq_audio_free(cdev);
 	usb_put_dev(cdev->chip.dev);
+	usb_free_urb(cdev->ep1_in_urb);
+	cdev->ep1_in_urb = NULL;
 }
 
 static int create_card(struct usb_device *usb_dev,
@@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 		return -EIO;
 	}
 
-	usb_init_urb(&cdev->ep1_in_urb);
+	cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+	usb_init_urb(cdev->ep1_in_urb);
 	usb_init_urb(&cdev->midi_out_urb);
 
-	usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
+	usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
 			  usb_rcvbulkpipe(usb_dev, 0x1),
 			  cdev->ep1_in_buf, EP1_BUFSIZE,
 			  usb_ep1_command_reply_dispatch, cdev);
@@ -471,7 +474,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 			  snd_usb_caiaq_midi_output_done, cdev);
 
 	/* sanity checks of EPs before actually submitting */
-	if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
+	if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
 	    usb_urb_ep_type_check(&cdev->midi_out_urb)) {
 		dev_err(dev, "invalid EPs\n");
 		return -EINVAL;
@@ -480,7 +483,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 	init_waitqueue_head(&cdev->ep1_wait_queue);
 	init_waitqueue_head(&cdev->prepare_wait_queue);
 
-	if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
+	if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
 		return -EIO;
 
 	err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
@@ -530,7 +533,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 	return 0;
 
  err_kill_urb:
-	usb_kill_urb(&cdev->ep1_in_urb);
+	usb_kill_urb(cdev->ep1_in_urb);
 	return err;
 }
 
@@ -576,7 +579,7 @@ static void snd_disconnect(struct usb_interface *intf)
 #endif
 	snd_usb_caiaq_audio_disconnect(cdev);
 
-	usb_kill_urb(&cdev->ep1_in_urb);
+	usb_kill_urb(cdev->ep1_in_urb);
 	usb_kill_urb(&cdev->midi_out_urb);
 
 	snd_card_free_when_closed(card);
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index 743eb0387b5f..a5f7dada25d8 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -60,7 +60,7 @@ struct snd_usb_caiaq_cb_info;
 struct snd_usb_caiaqdev {
 	struct snd_usb_audio chip;
 
-	struct urb ep1_in_urb;
+	struct urb *ep1_in_urb;
 	struct urb midi_out_urb;
 	struct urb **data_urbs_in;
 	struct urb **data_urbs_out;
-- 
2.43.0

Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb

[Michal Pecio]

On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30
> dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> 
> usb 1-1: received EP1 urb->status = -2
> ==================================================================
> BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
> BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
> BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline]
> BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline]
> BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline]
> BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline]
> BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> 
> CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
>  print_address_description+0x55/0x1e0 mm/kasan/report.c:378
>  print_report+0x58/0x70 mm/kasan/report.c:482
>  kasan_report+0x117/0x150 mm/kasan/report.c:595
>  check_region_inline mm/kasan/generic.c:-1 [inline]
>  kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
>  instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
>  atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
>  __refcount_sub_and_test include/linux/refcount.h:389 [inline]
>  __refcount_dec_and_test include/linux/refcount.h:432 [inline]
>  refcount_dec_and_test include/linux/refcount.h:450 [inline]
>  kref_put include/linux/kref.h:64 [inline]
>  usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
>  dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
>  __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
>  __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
>  hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
>  handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
>  __do_softirq kernel/softirq.c:679 [inline]
>  run_ktimerd+0x6a/0x100 kernel/softirq.c:1183
>  smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
>  kthread+0x38b/0x470 kernel/kthread.c:436
>  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>

[Adding sound people]

So what happens here is that USB core continues to use a URB after
completion to implement things like usb_kill_urb(), so URBs are
reference counted. Then core decrements the count - one more use.

If a driver waits for completion or even usb_kill_urb() to return
and then proceeds to free the URB's storage, this becomes a UAF.
This driver embeds 2 URBs in its priv and does just that.

A URB can only exist as an independent allocation, core will free
it if upon finding zero reference count in such case.

This is a mechanical conversion, untested. I don't have the HW.

#syz test

diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index a16e59248480..3587794207d4 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -192,8 +192,7 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
 		break;
 	}
 
-	cdev->ep1_in_urb.actual_length = 0;
-	ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
+	ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
 	if (ret < 0)
 		dev_err(dev, "unable to submit urb. OOM!?\n");
 }
@@ -403,6 +402,8 @@ static void card_free(struct snd_card *card)
 {
 	struct snd_usb_caiaqdev *cdev = caiaqdev(card);
 
+	usb_free_urb(cdev->ep1_in_urb);
+	usb_free_urb(cdev->midi_out_urb);
 #ifdef CONFIG_SND_USB_CAIAQ_INPUT
 	snd_usb_caiaq_input_free(cdev);
 #endif
@@ -457,22 +458,24 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 		return -EIO;
 	}
 
-	usb_init_urb(&cdev->ep1_in_urb);
-	usb_init_urb(&cdev->midi_out_urb);
+	cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+	cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!cdev->ep1_in_urb || !cdev->midi_out_urb)
+		return -ENOMEM;
 
-	usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
+	usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
 			  usb_rcvbulkpipe(usb_dev, 0x1),
 			  cdev->ep1_in_buf, EP1_BUFSIZE,
 			  usb_ep1_command_reply_dispatch, cdev);
 
-	usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
+	usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev,
 			  usb_sndbulkpipe(usb_dev, 0x1),
 			  cdev->midi_out_buf, EP1_BUFSIZE,
 			  snd_usb_caiaq_midi_output_done, cdev);
 
 	/* sanity checks of EPs before actually submitting */
-	if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
-	    usb_urb_ep_type_check(&cdev->midi_out_urb)) {
+	if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
+	    usb_urb_ep_type_check(cdev->midi_out_urb)) {
 		dev_err(dev, "invalid EPs\n");
 		return -EINVAL;
 	}
@@ -480,7 +483,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 	init_waitqueue_head(&cdev->ep1_wait_queue);
 	init_waitqueue_head(&cdev->prepare_wait_queue);
 
-	if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
+	if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
 		return -EIO;
 
 	err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
@@ -530,7 +533,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 	return 0;
 
  err_kill_urb:
-	usb_kill_urb(&cdev->ep1_in_urb);
+	usb_kill_urb(cdev->ep1_in_urb);
 	return err;
 }
 
@@ -576,8 +579,8 @@ static void snd_disconnect(struct usb_interface *intf)
 #endif
 	snd_usb_caiaq_audio_disconnect(cdev);
 
-	usb_kill_urb(&cdev->ep1_in_urb);
-	usb_kill_urb(&cdev->midi_out_urb);
+	usb_kill_urb(cdev->ep1_in_urb);
+	usb_kill_urb(cdev->midi_out_urb);
 
 	snd_card_free_when_closed(card);
 }
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index 743eb0387b5f..1c6f34693fa8 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info;
 struct snd_usb_caiaqdev {
 	struct snd_usb_audio chip;
 
-	struct urb ep1_in_urb;
-	struct urb midi_out_urb;
+	struct urb *ep1_in_urb;
+	struct urb *midi_out_urb;
 	struct urb **data_urbs_in;
 	struct urb **data_urbs_out;
 	struct snd_usb_caiaq_cb_info *data_cb_info;
diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
index c656d0162432..18529484c8dc 100644
--- a/sound/usb/caiaq/midi.c
+++ b/sound/usb/caiaq/midi.c
@@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre
 {
 	struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data;
 	if (cdev->midi_out_active) {
-		usb_kill_urb(&cdev->midi_out_urb);
+		usb_kill_urb(cdev->midi_out_urb);
 		cdev->midi_out_active = 0;
 	}
 	return 0;
@@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev,
 		return;
 
 	cdev->midi_out_buf[2] = len;
-	cdev->midi_out_urb.transfer_buffer_length = len+3;
+	cdev->midi_out_urb->transfer_buffer_length = len+3;
 
-	ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC);
+	ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC);
 	if (ret < 0)
 		dev_err(dev,
 			"snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"

Re: [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

[Takashi Iwai]

On Thu, 03 Sep 2026 10:47:47 +0200,
Edward Adam Davis wrote:
> 
> The epq_in_urb object belonging to the caiaq device is coupled within
> the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
> executes successfully, epq_in_urb is successfully added to the urbp_list
> queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
> layer driver for the caiaq USB device).
> 
> When init_card() calls snd_usb_caiaq_send_command() which subsequently
> fails due to a timeout, and proceeds to call snd_card_free() to release
> the card, the embedded ep1_in_urb object is also freed. When the dummy
> HCD driver detects that the URB has been unlinked, it returns the URB
> (by usb_hcd_giveback_urb()), which triggers [1].
> 
> Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
> to using a pointer instead. Separately allocate and manage the memory for
> ep1_in_urb to prevent the release of the snd_card memory object from
> interfering with it.
> 
> [1]
> BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> Call Trace:
>  usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
>  dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
>  __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
>  __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
>  hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
> 
> Allocated by task 36:
>  snd_card_new+0x7b/0x110 sound/core/init.c:184
>  create_card sound/usb/caiaq/device.c:429 [inline]
>  snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
> 
> Freed by task 36:
>  snd_card_free_when_closed sound/core/init.c:630 [inline]
>  snd_card_free+0x138/0x1d0 sound/core/init.c:662
>  snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
>  
> Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
> Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> ---
>  sound/usb/caiaq/device.c | 19 +++++++++++--------
>  sound/usb/caiaq/device.h |  2 +-
>  2 files changed, 12 insertions(+), 9 deletions(-)
> 
> diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
> index a16e59248480..138b58914f1c 100644
> --- a/sound/usb/caiaq/device.c
> +++ b/sound/usb/caiaq/device.c
> @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
>  		break;
>  	}
>  
> -	cdev->ep1_in_urb.actual_length = 0;
> -	ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
> +	cdev->ep1_in_urb->actual_length = 0;
> +	ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
>  	if (ret < 0)
>  		dev_err(dev, "unable to submit urb. OOM!?\n");
>  }
> @@ -408,6 +408,8 @@ static void card_free(struct snd_card *card)
>  #endif
>  	snd_usb_caiaq_audio_free(cdev);
>  	usb_put_dev(cdev->chip.dev);
> +	usb_free_urb(cdev->ep1_in_urb);
> +	cdev->ep1_in_urb = NULL;
>  }
>  
>  static int create_card(struct usb_device *usb_dev,
> @@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
>  		return -EIO;
>  	}
>  
> -	usb_init_urb(&cdev->ep1_in_urb);
> +	cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
> +	usb_init_urb(cdev->ep1_in_urb);

The error check is missing here, as sashiko review pointed out.
Could you fix and resubmit?

(The other issues reported there -- the potential-double-free and the
midi_out_urb handling can be skipped here; I'll fix those
individually.)


thanks,

Takashi

Re: [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

[Edward Adam Davis]

From: Edward Aadm Davis <eadavis@sina.com>

On Thu, 03 Sep 2026 11:32:22 +0200, Takashi Iwai wrote:
> > The epq_in_urb object belonging to the caiaq device is coupled within
> > the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
> > executes successfully, epq_in_urb is successfully added to the urbp_list
> > queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
> > layer driver for the caiaq USB device).
> >
> > When init_card() calls snd_usb_caiaq_send_command() which subsequently
> > fails due to a timeout, and proceeds to call snd_card_free() to release
> > the card, the embedded ep1_in_urb object is also freed. When the dummy
> > HCD driver detects that the URB has been unlinked, it returns the URB
> > (by usb_hcd_giveback_urb()), which triggers [1].
> >
> > Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
> > to using a pointer instead. Separately allocate and manage the memory for
> > ep1_in_urb to prevent the release of the snd_card memory object from
> > interfering with it.
> >
> > [1]
> > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> > Call Trace:
> >  usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> >  dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
> >  __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
> >  __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
> >  hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
> >
> > Allocated by task 36:
> >  snd_card_new+0x7b/0x110 sound/core/init.c:184
> >  create_card sound/usb/caiaq/device.c:429 [inline]
> >  snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
> >
> > Freed by task 36:
> >  snd_card_free_when_closed sound/core/init.c:630 [inline]
> >  snd_card_free+0x138/0x1d0 sound/core/init.c:662
> >  snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
> >
> > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> > Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
> > Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> > Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> > Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> > ---
> >  sound/usb/caiaq/device.c | 19 +++++++++++--------
> >  sound/usb/caiaq/device.h |  2 +-
> >  2 files changed, 12 insertions(+), 9 deletions(-)
> >
> > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
> > index a16e59248480..138b58914f1c 100644
> > --- a/sound/usb/caiaq/device.c
> > +++ b/sound/usb/caiaq/device.c
> > @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
> >  		break;
> >  	}
> >
> > -	cdev->ep1_in_urb.actual_length = 0;
> > -	ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
> > +	cdev->ep1_in_urb->actual_length = 0;
> > +	ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
> >  	if (ret < 0)
> >  		dev_err(dev, "unable to submit urb. OOM!?\n");
> >  }
> > @@ -408,6 +408,8 @@ static void card_free(struct snd_card *card)
> >  #endif
> >  	snd_usb_caiaq_audio_free(cdev);
> >  	usb_put_dev(cdev->chip.dev);
> > +	usb_free_urb(cdev->ep1_in_urb);
> > +	cdev->ep1_in_urb = NULL;
> >  }
> >
> >  static int create_card(struct usb_device *usb_dev,
> > @@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
> >  		return -EIO;
> >  	}
> >
> > -	usb_init_urb(&cdev->ep1_in_urb);
> > +	cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
> > +	usb_init_urb(cdev->ep1_in_urb);
> 
> The error check is missing here, as sashiko review pointed out.
> Could you fix and resubmit?
OK. I will fix and resubmit.
> 
> (The other issues reported there -- the potential-double-free and the
> midi_out_urb handling can be skipped here; I'll fix those
> individually.)
I can handle `midi_out_urb` as well.

BR,
Edward

Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb

[Takashi Iwai]

On Thu, 03 Sep 2026 11:24:17 +0200,
Michal Pecio wrote:
> 
> On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote:
> > syzbot has found a reproducer for the following issue on:
> > 
> > HEAD commit:    786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:..
> > git tree:       upstream
> > console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30
> > dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> > compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000
> > 
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz
> > 
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> > 
> > usb 1-1: received EP1 urb->status = -2
> > ==================================================================
> > BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
> > BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
> > BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline]
> > BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline]
> > BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline]
> > BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline]
> > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> > 
> > CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> > Call Trace:
> >  <TASK>
> >  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
> >  print_address_description+0x55/0x1e0 mm/kasan/report.c:378
> >  print_report+0x58/0x70 mm/kasan/report.c:482
> >  kasan_report+0x117/0x150 mm/kasan/report.c:595
> >  check_region_inline mm/kasan/generic.c:-1 [inline]
> >  kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
> >  instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
> >  atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
> >  __refcount_sub_and_test include/linux/refcount.h:389 [inline]
> >  __refcount_dec_and_test include/linux/refcount.h:432 [inline]
> >  refcount_dec_and_test include/linux/refcount.h:450 [inline]
> >  kref_put include/linux/kref.h:64 [inline]
> >  usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> >  dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
> >  __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
> >  __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
> >  hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
> >  handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
> >  __do_softirq kernel/softirq.c:679 [inline]
> >  run_ktimerd+0x6a/0x100 kernel/softirq.c:1183
> >  smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
> >  kthread+0x38b/0x470 kernel/kthread.c:436
> >  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
> >  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> >  </TASK>
> 
> [Adding sound people]
> 
> So what happens here is that USB core continues to use a URB after
> completion to implement things like usb_kill_urb(), so URBs are
> reference counted. Then core decrements the count - one more use.
> 
> If a driver waits for completion or even usb_kill_urb() to return
> and then proceeds to free the URB's storage, this becomes a UAF.
> This driver embeds 2 URBs in its priv and does just that.
> 
> A URB can only exist as an independent allocation, core will free
> it if upon finding zero reference count in such case.
> 
> This is a mechanical conversion, untested. I don't have the HW.

This should work, and we've received another similar patch submission
already.

So, IIUC, now the URB *must* be always allocated via usb_alloc_urb()
and an embedded URB isn't allowed?  If so, we'd need to address other
drivers, too.


thanks,

Takashi

Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb

[Hillf Danton]

On Thu, 3 Sep 2026 11:24:17 +0200 Michal Pecio wrote:
>On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote:
>> syzbot has found a reproducer for the following issue on:
>> 
>> HEAD commit:    786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:..
>> git tree:       upstream
>> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30
>> dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
>> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000
>> 
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz
>> 
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
>> 
>> usb 1-1: received EP1 urb->status = -2
>> ==================================================================
>> BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
>> BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
>> BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline]
>> BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline]
>> BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline]
>> BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline]
>> BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
>> Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
>> 
>> CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
>> Call Trace:
>>  <TASK>
>>  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
>>  print_address_description+0x55/0x1e0 mm/kasan/report.c:378
>>  print_report+0x58/0x70 mm/kasan/report.c:482
>>  kasan_report+0x117/0x150 mm/kasan/report.c:595
>>  check_region_inline mm/kasan/generic.c:-1 [inline]
>>  kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
>>  instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
>>  atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
>>  __refcount_sub_and_test include/linux/refcount.h:389 [inline]
>>  __refcount_dec_and_test include/linux/refcount.h:432 [inline]
>>  refcount_dec_and_test include/linux/refcount.h:450 [inline]
>>  kref_put include/linux/kref.h:64 [inline]
>>  usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
>>  dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
>>  __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
>>  __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
>>  hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
>>  handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
>>  __do_softirq kernel/softirq.c:679 [inline]
>>  run_ktimerd+0x6a/0x100 kernel/softirq.c:1183
>>  smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
>>  kthread+0x38b/0x470 kernel/kthread.c:436
>>  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
>>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>  </TASK>
>
>[Adding sound people]
>
> So what happens here is that USB core continues to use a URB after
> completion to implement things like usb_kill_urb(), so URBs are
> reference counted. Then core decrements the count - one more use.
> 
> If a driver waits for completion or even usb_kill_urb() to return
> and then proceeds to free the URB's storage, this becomes a UAF.
> This driver embeds 2 URBs in its priv and does just that.
>
Given dummy_urb_dequeue(), the dequeued urb should be tagged not to
be handled again in the dummy_timer callback instead, just my $0.02

Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com

Tested on:

commit:         940de590 Merge tag 'hardening-v7.3-rc2' of git://git.k..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13da7c15580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30
dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15527c15580000

Note: testing is done by a robot and is best-effort only.

Re: [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

[Takashi Iwai]

On Thu, 03 Sep 2026 11:41:05 +0200,
Edward Adam Davis wrote:
> 
> From: Edward Aadm Davis <eadavis@sina.com>
> 
> On Thu, 03 Sep 2026 11:32:22 +0200, Takashi Iwai wrote:
> > > The epq_in_urb object belonging to the caiaq device is coupled within
> > > the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
> > > executes successfully, epq_in_urb is successfully added to the urbp_list
> > > queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
> > > layer driver for the caiaq USB device).
> > >
> > > When init_card() calls snd_usb_caiaq_send_command() which subsequently
> > > fails due to a timeout, and proceeds to call snd_card_free() to release
> > > the card, the embedded ep1_in_urb object is also freed. When the dummy
> > > HCD driver detects that the URB has been unlinked, it returns the URB
> > > (by usb_hcd_giveback_urb()), which triggers [1].
> > >
> > > Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
> > > to using a pointer instead. Separately allocate and manage the memory for
> > > ep1_in_urb to prevent the release of the snd_card memory object from
> > > interfering with it.
> > >
> > > [1]
> > > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> > > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> > > Call Trace:
> > >  usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> > >  dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
> > >  __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
> > >  __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
> > >  hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
> > >
> > > Allocated by task 36:
> > >  snd_card_new+0x7b/0x110 sound/core/init.c:184
> > >  create_card sound/usb/caiaq/device.c:429 [inline]
> > >  snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
> > >
> > > Freed by task 36:
> > >  snd_card_free_when_closed sound/core/init.c:630 [inline]
> > >  snd_card_free+0x138/0x1d0 sound/core/init.c:662
> > >  snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
> > >
> > > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> > > Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
> > > Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> > > Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> > > Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> > > ---
> > >  sound/usb/caiaq/device.c | 19 +++++++++++--------
> > >  sound/usb/caiaq/device.h |  2 +-
> > >  2 files changed, 12 insertions(+), 9 deletions(-)
> > >
> > > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
> > > index a16e59248480..138b58914f1c 100644
> > > --- a/sound/usb/caiaq/device.c
> > > +++ b/sound/usb/caiaq/device.c
> > > @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
> > >  		break;
> > >  	}
> > >
> > > -	cdev->ep1_in_urb.actual_length = 0;
> > > -	ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
> > > +	cdev->ep1_in_urb->actual_length = 0;
> > > +	ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
> > >  	if (ret < 0)
> > >  		dev_err(dev, "unable to submit urb. OOM!?\n");
> > >  }
> > > @@ -408,6 +408,8 @@ static void card_free(struct snd_card *card)
> > >  #endif
> > >  	snd_usb_caiaq_audio_free(cdev);
> > >  	usb_put_dev(cdev->chip.dev);
> > > +	usb_free_urb(cdev->ep1_in_urb);
> > > +	cdev->ep1_in_urb = NULL;
> > >  }
> > >
> > >  static int create_card(struct usb_device *usb_dev,
> > > @@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
> > >  		return -EIO;
> > >  	}
> > >
> > > -	usb_init_urb(&cdev->ep1_in_urb);
> > > +	cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
> > > +	usb_init_urb(cdev->ep1_in_urb);
> > 
> > The error check is missing here, as sashiko review pointed out.
> > Could you fix and resubmit?
> OK. I will fix and resubmit.
> > 
> > (The other issues reported there -- the potential-double-free and the
> > midi_out_urb handling can be skipped here; I'll fix those
> > individually.)
> I can handle `midi_out_urb` as well.

OK, then let's shoot both URBs in a shot.


thanks,

Takashi

[PATCH v2] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

[Edward Adam Davis]

The epq_in_urb object belonging to the caiaq device is coupled within
the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
executes successfully, epq_in_urb is successfully added to the urbp_list
queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
layer driver for the caiaq USB device).

When init_card() calls snd_usb_caiaq_send_command() which subsequently
fails due to a timeout, and proceeds to call snd_card_free() to release
the card, the embedded ep1_in_urb object is also freed. When the dummy
HCD driver detects that the URB has been unlinked, it returns the URB
(by usb_hcd_giveback_urb()), which triggers [1].

Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
to using a pointer instead. Separately allocate and manage the memory for
ep1_in_urb to prevent the release of the snd_card memory object from
interfering with it.

midi_out_urb has the same issue as ep1_in_urb and is handled in the same
way.

[1]
BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
Call Trace:
 usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
 dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
 __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
 hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141

Allocated by task 36:
 snd_card_new+0x7b/0x110 sound/core/init.c:184
 create_card sound/usb/caiaq/device.c:429 [inline]
 snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544

Freed by task 36:
 snd_card_free_when_closed sound/core/init.c:630 [inline]
 snd_card_free+0x138/0x1d0 sound/core/init.c:662
 snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
 
Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
v1 -> v2: same dealwith midi_out_urb and add missing check

 sound/usb/caiaq/device.c | 39 +++++++++++++++++++++++++++------------
 sound/usb/caiaq/device.h |  4 ++--
 sound/usb/caiaq/midi.c   |  6 +++---
 3 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index a16e59248480..d0fe954b8133 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
 		break;
 	}
 
-	cdev->ep1_in_urb.actual_length = 0;
-	ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
+	cdev->ep1_in_urb->actual_length = 0;
+	ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
 	if (ret < 0)
 		dev_err(dev, "unable to submit urb. OOM!?\n");
 }
@@ -408,6 +408,10 @@ static void card_free(struct snd_card *card)
 #endif
 	snd_usb_caiaq_audio_free(cdev);
 	usb_put_dev(cdev->chip.dev);
+	usb_free_urb(cdev->ep1_in_urb);
+	cdev->ep1_in_urb = NULL;
+	usb_free_urb(cdev->midi_out_urb);
+	cdev->midi_out_urb = NULL;
 }
 
 static int create_card(struct usb_device *usb_dev,
@@ -457,22 +461,33 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 		return -EIO;
 	}
 
-	usb_init_urb(&cdev->ep1_in_urb);
-	usb_init_urb(&cdev->midi_out_urb);
+	cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!cdev->ep1_in_urb) {
+		dev_err(dev, "alloc ep1_in_urb failed.\n");
+		return -ENOMEM;
+	}
+	cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!cdev->midi_out_urb) {
+		usb_free_urb(cdev->ep1_in_urb);
+		dev_err(dev, "alloc midi_out_urb failed.\n");
+		return -ENOMEM;
+	}
+	usb_init_urb(cdev->ep1_in_urb);
+	usb_init_urb(cdev->midi_out_urb);
 
-	usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
+	usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
 			  usb_rcvbulkpipe(usb_dev, 0x1),
 			  cdev->ep1_in_buf, EP1_BUFSIZE,
 			  usb_ep1_command_reply_dispatch, cdev);
 
-	usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
+	usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev,
 			  usb_sndbulkpipe(usb_dev, 0x1),
 			  cdev->midi_out_buf, EP1_BUFSIZE,
 			  snd_usb_caiaq_midi_output_done, cdev);
 
 	/* sanity checks of EPs before actually submitting */
-	if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
-	    usb_urb_ep_type_check(&cdev->midi_out_urb)) {
+	if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
+	    usb_urb_ep_type_check(cdev->midi_out_urb)) {
 		dev_err(dev, "invalid EPs\n");
 		return -EINVAL;
 	}
@@ -480,7 +495,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 	init_waitqueue_head(&cdev->ep1_wait_queue);
 	init_waitqueue_head(&cdev->prepare_wait_queue);
 
-	if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
+	if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
 		return -EIO;
 
 	err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
@@ -530,7 +545,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 	return 0;
 
  err_kill_urb:
-	usb_kill_urb(&cdev->ep1_in_urb);
+	usb_kill_urb(cdev->ep1_in_urb);
 	return err;
 }
 
@@ -576,8 +591,8 @@ static void snd_disconnect(struct usb_interface *intf)
 #endif
 	snd_usb_caiaq_audio_disconnect(cdev);
 
-	usb_kill_urb(&cdev->ep1_in_urb);
-	usb_kill_urb(&cdev->midi_out_urb);
+	usb_kill_urb(cdev->ep1_in_urb);
+	usb_kill_urb(cdev->midi_out_urb);
 
 	snd_card_free_when_closed(card);
 }
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index 743eb0387b5f..1c6f34693fa8 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info;
 struct snd_usb_caiaqdev {
 	struct snd_usb_audio chip;
 
-	struct urb ep1_in_urb;
-	struct urb midi_out_urb;
+	struct urb *ep1_in_urb;
+	struct urb *midi_out_urb;
 	struct urb **data_urbs_in;
 	struct urb **data_urbs_out;
 	struct snd_usb_caiaq_cb_info *data_cb_info;
diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
index c656d0162432..18529484c8dc 100644
--- a/sound/usb/caiaq/midi.c
+++ b/sound/usb/caiaq/midi.c
@@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre
 {
 	struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data;
 	if (cdev->midi_out_active) {
-		usb_kill_urb(&cdev->midi_out_urb);
+		usb_kill_urb(cdev->midi_out_urb);
 		cdev->midi_out_active = 0;
 	}
 	return 0;
@@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev,
 		return;
 
 	cdev->midi_out_buf[2] = len;
-	cdev->midi_out_urb.transfer_buffer_length = len+3;
+	cdev->midi_out_urb->transfer_buffer_length = len+3;
 
-	ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC);
+	ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC);
 	if (ret < 0)
 		dev_err(dev,
 			"snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"
-- 
2.43.0

DIY allocation or embedding of URBs in larger structures

[Michal Pecio]

On Thu, 03 Sep 2026 11:44:45 +0200, Takashi Iwai wrote:
> On Thu, 03 Sep 2026 11:24:17 +0200,
> Michal Pecio wrote:
> > So what happens here is that USB core continues to use a URB after
> > completion to implement things like usb_kill_urb(), so URBs are
> > reference counted. Then core decrements the count - one more use.
> > 
> > If a driver waits for completion or even usb_kill_urb() to return
> > and then proceeds to free the URB's storage, this becomes a UAF.
> > This driver embeds 2 URBs in its priv and does just that.
> > 
> > A URB can only exist as an independent allocation, core will free
> > it if upon finding zero reference count in such case.
>
> So, IIUC, now the URB *must* be always allocated via usb_alloc_urb()
> and an embedded URB isn't allowed?  If so, we'd need to address other
> drivers, too.

Yes, that's basically the case and actually has been for a long time.

The only thing that works is for both USB and the driver to call
usb_free_urb() and whoever does last will actually free the storage.
This means URB can't share storage with anything else.

Some drivers got away with making URB the first member of a struct
which is freed together with it. AFAIK this pattern doesn't crash, but
it's deprecated too because it puts a flexible member (in the URB) in
the middle of (the outer) struct.

This pattern here in caiaq has always been one race away from UAF.
Maybe it wasn't very likely to happen, but stuff like PREEMPT_RT and
hypervisors can insert unexpected delays anywhere these days.

Greg KH puts it thusly:
https://lore.kernel.org/linux-usb/2025120716-sway-hypnotic-8cb6@gregkh/

Reragds,
Michal

Re: [PATCH v2] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

[Michal Pecio]

On Thu,  3 Sep 2026 18:04:10 +0800, Edward Adam Davis wrote:
> The epq_in_urb object belonging to the caiaq device is coupled within
> the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
> executes successfully, epq_in_urb is successfully added to the urbp_list
> queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
> layer driver for the caiaq USB device).

Sounds like an irrelevant detail. Same crash would happen with any HCD.
 
> When init_card() calls snd_usb_caiaq_send_command() which subsequently
> fails due to a timeout, and proceeds to call snd_card_free() to release
> the card, the embedded ep1_in_urb object is also freed. When the dummy
> HCD driver detects that the URB has been unlinked, it returns the URB
> (by usb_hcd_giveback_urb()), which triggers [1].
> 
> Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
> to using a pointer instead. Separately allocate and manage the memory for
> ep1_in_urb to prevent the release of the snd_card memory object from
> interfering with it.
> 
> midi_out_urb has the same issue as ep1_in_urb and is handled in the same
> way.
> 
> [1]
> BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> Call Trace:
>  usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
>  dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
>  __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
>  __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
>  hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
> 
> Allocated by task 36:
>  snd_card_new+0x7b/0x110 sound/core/init.c:184
>  create_card sound/usb/caiaq/device.c:429 [inline]
>  snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
> 
> Freed by task 36:
>  snd_card_free_when_closed sound/core/init.c:630 [inline]
>  snd_card_free+0x138/0x1d0 sound/core/init.c:662
>  snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
>  
> Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
> Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> ---

Does this submission comply with the rules here?
https://docs.kernel.org/process/coding-assistants.html

> v1 -> v2: same dealwith midi_out_urb and add missing check
> 
>  sound/usb/caiaq/device.c | 39 +++++++++++++++++++++++++++------------
>  sound/usb/caiaq/device.h |  4 ++--
>  sound/usb/caiaq/midi.c   |  6 +++---
>  3 files changed, 32 insertions(+), 17 deletions(-)
> 
> diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
> index a16e59248480..d0fe954b8133 100644
> --- a/sound/usb/caiaq/device.c
> +++ b/sound/usb/caiaq/device.c
> @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
>  		break;
>  	}
>  
> -	cdev->ep1_in_urb.actual_length = 0;
> -	ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
> +	cdev->ep1_in_urb->actual_length = 0;

That's one of the first things usb_submit_urb() below would do,
and has done since forever.

> +	ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
>  	if (ret < 0)
>  		dev_err(dev, "unable to submit urb. OOM!?\n");
>  }
> @@ -408,6 +408,10 @@ static void card_free(struct snd_card *card)
>  #endif
>  	snd_usb_caiaq_audio_free(cdev);
>  	usb_put_dev(cdev->chip.dev);
> +	usb_free_urb(cdev->ep1_in_urb);
> +	cdev->ep1_in_urb = NULL;
> +	usb_free_urb(cdev->midi_out_urb);
> +	cdev->midi_out_urb = NULL;

Is clearing this necessary? (I'm not familiar with ALSA)

>  }
>  
>  static int create_card(struct usb_device *usb_dev,
> @@ -457,22 +461,33 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
>  		return -EIO;
>  	}
>  
> -	usb_init_urb(&cdev->ep1_in_urb);
> -	usb_init_urb(&cdev->midi_out_urb);
> +	cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
> +	if (!cdev->ep1_in_urb) {
> +		dev_err(dev, "alloc ep1_in_urb failed.\n");

AFAIK logging on allocation failure is frowned upon.

> +		return -ENOMEM;
> +	}
> +	cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL);
> +	if (!cdev->midi_out_urb) {
> +		usb_free_urb(cdev->ep1_in_urb);
> +		dev_err(dev, "alloc midi_out_urb failed.\n");
> +		return -ENOMEM;
> +	}
> +	usb_init_urb(cdev->ep1_in_urb);
> +	usb_init_urb(cdev->midi_out_urb);

And what would be the point of that?

>  
> -	usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
> +	usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
>  			  usb_rcvbulkpipe(usb_dev, 0x1),
>  			  cdev->ep1_in_buf, EP1_BUFSIZE,
>  			  usb_ep1_command_reply_dispatch, cdev);
>  
> -	usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
> +	usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev,
>  			  usb_sndbulkpipe(usb_dev, 0x1),
>  			  cdev->midi_out_buf, EP1_BUFSIZE,
>  			  snd_usb_caiaq_midi_output_done, cdev);
>  
>  	/* sanity checks of EPs before actually submitting */
> -	if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
> -	    usb_urb_ep_type_check(&cdev->midi_out_urb)) {
> +	if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
> +	    usb_urb_ep_type_check(cdev->midi_out_urb)) {
>  		dev_err(dev, "invalid EPs\n");
>  		return -EINVAL;
>  	}
> @@ -480,7 +495,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
>  	init_waitqueue_head(&cdev->ep1_wait_queue);
>  	init_waitqueue_head(&cdev->prepare_wait_queue);
>  
> -	if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
> +	if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
>  		return -EIO;
>  
>  	err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
> @@ -530,7 +545,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
>  	return 0;
>  
>   err_kill_urb:
> -	usb_kill_urb(&cdev->ep1_in_urb);
> +	usb_kill_urb(cdev->ep1_in_urb);
>  	return err;
>  }
>  
> @@ -576,8 +591,8 @@ static void snd_disconnect(struct usb_interface *intf)
>  #endif
>  	snd_usb_caiaq_audio_disconnect(cdev);
>  
> -	usb_kill_urb(&cdev->ep1_in_urb);
> -	usb_kill_urb(&cdev->midi_out_urb);
> +	usb_kill_urb(cdev->ep1_in_urb);
> +	usb_kill_urb(cdev->midi_out_urb);
>  
>  	snd_card_free_when_closed(card);
>  }
> diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
> index 743eb0387b5f..1c6f34693fa8 100644
> --- a/sound/usb/caiaq/device.h
> +++ b/sound/usb/caiaq/device.h
> @@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info;
>  struct snd_usb_caiaqdev {
>  	struct snd_usb_audio chip;
>  
> -	struct urb ep1_in_urb;
> -	struct urb midi_out_urb;
> +	struct urb *ep1_in_urb;
> +	struct urb *midi_out_urb;
>  	struct urb **data_urbs_in;
>  	struct urb **data_urbs_out;
>  	struct snd_usb_caiaq_cb_info *data_cb_info;
> diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
> index c656d0162432..18529484c8dc 100644
> --- a/sound/usb/caiaq/midi.c
> +++ b/sound/usb/caiaq/midi.c
> @@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre
>  {
>  	struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data;
>  	if (cdev->midi_out_active) {
> -		usb_kill_urb(&cdev->midi_out_urb);
> +		usb_kill_urb(cdev->midi_out_urb);
>  		cdev->midi_out_active = 0;
>  	}
>  	return 0;
> @@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev,
>  		return;
>  
>  	cdev->midi_out_buf[2] = len;
> -	cdev->midi_out_urb.transfer_buffer_length = len+3;
> +	cdev->midi_out_urb->transfer_buffer_length = len+3;
>  
> -	ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC);
> +	ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC);
>  	if (ret < 0)
>  		dev_err(dev,
>  			"snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"
> -- 
> 2.43.0
> 

[PATCH v3] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

[Edward Adam Davis]

The epq_in_urb object belonging to the caiaq device is coupled within
the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
executes successfully, epq_in_urb is successfully added to the urbp_list
queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
layer driver for the caiaq USB device).

When init_card() calls snd_usb_caiaq_send_command() which subsequently
fails due to a timeout, and proceeds to call snd_card_free() to release
the card, the embedded ep1_in_urb object is also freed. When the dummy
HCD driver detects that the URB has been unlinked, it returns the URB
(by usb_hcd_giveback_urb()), which triggers [1].

Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
to using a pointer instead. Separately allocate and manage the memory for
ep1_in_urb to prevent the release of the snd_card memory object from
interfering with it.

midi_out_urb has the same issue as ep1_in_urb and is handled in the same
way.

[1]
BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
Call Trace:
 usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
 dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
 __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
 hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141

Allocated by task 36:
 snd_card_new+0x7b/0x110 sound/core/init.c:184
 create_card sound/usb/caiaq/device.c:429 [inline]
 snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544

Freed by task 36:
 snd_card_free_when_closed sound/core/init.c:630 [inline]
 snd_card_free+0x138/0x1d0 sound/core/init.c:662
 snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
 
Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
v1 -> v2: same dealwith midi_out_urb and add missing check
v2 -> v3: set ep1_in_urb to NULL after midi_out_urb allow failed
          remove err message when alloc failed

 sound/usb/caiaq/device.c | 38 ++++++++++++++++++++++++++------------
 sound/usb/caiaq/device.h |  4 ++--
 sound/usb/caiaq/midi.c   |  6 +++---
 3 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index a16e59248480..ff761978a1cf 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
 		break;
 	}
 
-	cdev->ep1_in_urb.actual_length = 0;
-	ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
+	cdev->ep1_in_urb->actual_length = 0;
+	ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
 	if (ret < 0)
 		dev_err(dev, "unable to submit urb. OOM!?\n");
 }
@@ -408,6 +408,10 @@ static void card_free(struct snd_card *card)
 #endif
 	snd_usb_caiaq_audio_free(cdev);
 	usb_put_dev(cdev->chip.dev);
+	usb_free_urb(cdev->ep1_in_urb);
+	cdev->ep1_in_urb = NULL;
+	usb_free_urb(cdev->midi_out_urb);
+	cdev->midi_out_urb = NULL;
 }
 
 static int create_card(struct usb_device *usb_dev,
@@ -457,22 +461,32 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 		return -EIO;
 	}
 
-	usb_init_urb(&cdev->ep1_in_urb);
-	usb_init_urb(&cdev->midi_out_urb);
+	cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!cdev->ep1_in_urb)
+		return -ENOMEM;
 
-	usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
+	cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!cdev->midi_out_urb) {
+		usb_free_urb(cdev->ep1_in_urb);
+		cdev->ep1_in_urb = NULL;
+		return -ENOMEM;
+	}
+	usb_init_urb(cdev->ep1_in_urb);
+	usb_init_urb(cdev->midi_out_urb);
+
+	usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
 			  usb_rcvbulkpipe(usb_dev, 0x1),
 			  cdev->ep1_in_buf, EP1_BUFSIZE,
 			  usb_ep1_command_reply_dispatch, cdev);
 
-	usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
+	usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev,
 			  usb_sndbulkpipe(usb_dev, 0x1),
 			  cdev->midi_out_buf, EP1_BUFSIZE,
 			  snd_usb_caiaq_midi_output_done, cdev);
 
 	/* sanity checks of EPs before actually submitting */
-	if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
-	    usb_urb_ep_type_check(&cdev->midi_out_urb)) {
+	if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
+	    usb_urb_ep_type_check(cdev->midi_out_urb)) {
 		dev_err(dev, "invalid EPs\n");
 		return -EINVAL;
 	}
@@ -480,7 +494,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 	init_waitqueue_head(&cdev->ep1_wait_queue);
 	init_waitqueue_head(&cdev->prepare_wait_queue);
 
-	if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
+	if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
 		return -EIO;
 
 	err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
@@ -530,7 +544,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 	return 0;
 
  err_kill_urb:
-	usb_kill_urb(&cdev->ep1_in_urb);
+	usb_kill_urb(cdev->ep1_in_urb);
 	return err;
 }
 
@@ -576,8 +590,8 @@ static void snd_disconnect(struct usb_interface *intf)
 #endif
 	snd_usb_caiaq_audio_disconnect(cdev);
 
-	usb_kill_urb(&cdev->ep1_in_urb);
-	usb_kill_urb(&cdev->midi_out_urb);
+	usb_kill_urb(cdev->ep1_in_urb);
+	usb_kill_urb(cdev->midi_out_urb);
 
 	snd_card_free_when_closed(card);
 }
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index 743eb0387b5f..1c6f34693fa8 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info;
 struct snd_usb_caiaqdev {
 	struct snd_usb_audio chip;
 
-	struct urb ep1_in_urb;
-	struct urb midi_out_urb;
+	struct urb *ep1_in_urb;
+	struct urb *midi_out_urb;
 	struct urb **data_urbs_in;
 	struct urb **data_urbs_out;
 	struct snd_usb_caiaq_cb_info *data_cb_info;
diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
index c656d0162432..18529484c8dc 100644
--- a/sound/usb/caiaq/midi.c
+++ b/sound/usb/caiaq/midi.c
@@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre
 {
 	struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data;
 	if (cdev->midi_out_active) {
-		usb_kill_urb(&cdev->midi_out_urb);
+		usb_kill_urb(cdev->midi_out_urb);
 		cdev->midi_out_active = 0;
 	}
 	return 0;
@@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev,
 		return;
 
 	cdev->midi_out_buf[2] = len;
-	cdev->midi_out_urb.transfer_buffer_length = len+3;
+	cdev->midi_out_urb->transfer_buffer_length = len+3;
 
-	ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC);
+	ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC);
 	if (ret < 0)
 		dev_err(dev,
 			"snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"
-- 
2.43.0

[PATCH v4] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

[Edward Adam Davis]

The epq_in_urb object belonging to the caiaq device is coupled within
the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
executes successfully, epq_in_urb is successfully added to the urbp_list
queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
layer driver for the caiaq USB device).

When init_card() calls snd_usb_caiaq_send_command() which subsequently
fails due to a timeout, and proceeds to call snd_card_free() to release
the card, the embedded ep1_in_urb object is also freed. When the dummy
HCD driver detects that the URB has been unlinked, it returns the URB
(by usb_hcd_giveback_urb()), which triggers [1].

Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
to using a pointer instead. Separately allocate and manage the memory for
ep1_in_urb to prevent the release of the snd_card memory object from
interfering with it.

midi_out_urb has the same issue as ep1_in_urb and is handled in the same
way.

[1]
BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
Call Trace:
 usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
 dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
 __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
 hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141

Allocated by task 36:
 snd_card_new+0x7b/0x110 sound/core/init.c:184
 create_card sound/usb/caiaq/device.c:429 [inline]
 snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544

Freed by task 36:
 snd_card_free_when_closed sound/core/init.c:630 [inline]
 snd_card_free+0x138/0x1d0 sound/core/init.c:662
 snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
 
Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
v1 -> v2: same dealwith midi_out_urb and add missing check
v2 -> v3: set ep1_in_urb to NULL after midi_out_urb allow failed
          remove err message when alloc failed
v3 -> v4: remove usb_init_urb() after use usb_alloc_urb

 sound/usb/caiaq/device.c | 36 ++++++++++++++++++++++++------------
 sound/usb/caiaq/device.h |  4 ++--
 sound/usb/caiaq/midi.c   |  6 +++---
 3 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index a16e59248480..3d821fde4582 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
 		break;
 	}
 
-	cdev->ep1_in_urb.actual_length = 0;
-	ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
+	cdev->ep1_in_urb->actual_length = 0;
+	ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
 	if (ret < 0)
 		dev_err(dev, "unable to submit urb. OOM!?\n");
 }
@@ -408,6 +408,10 @@ static void card_free(struct snd_card *card)
 #endif
 	snd_usb_caiaq_audio_free(cdev);
 	usb_put_dev(cdev->chip.dev);
+	usb_free_urb(cdev->ep1_in_urb);
+	cdev->ep1_in_urb = NULL;
+	usb_free_urb(cdev->midi_out_urb);
+	cdev->midi_out_urb = NULL;
 }
 
 static int create_card(struct usb_device *usb_dev,
@@ -457,22 +461,30 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 		return -EIO;
 	}
 
-	usb_init_urb(&cdev->ep1_in_urb);
-	usb_init_urb(&cdev->midi_out_urb);
+	cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!cdev->ep1_in_urb)
+		return -ENOMEM;
 
-	usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
+	cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!cdev->midi_out_urb) {
+		usb_free_urb(cdev->ep1_in_urb);
+		cdev->ep1_in_urb = NULL;
+		return -ENOMEM;
+	}
+
+	usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
 			  usb_rcvbulkpipe(usb_dev, 0x1),
 			  cdev->ep1_in_buf, EP1_BUFSIZE,
 			  usb_ep1_command_reply_dispatch, cdev);
 
-	usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
+	usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev,
 			  usb_sndbulkpipe(usb_dev, 0x1),
 			  cdev->midi_out_buf, EP1_BUFSIZE,
 			  snd_usb_caiaq_midi_output_done, cdev);
 
 	/* sanity checks of EPs before actually submitting */
-	if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
-	    usb_urb_ep_type_check(&cdev->midi_out_urb)) {
+	if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
+	    usb_urb_ep_type_check(cdev->midi_out_urb)) {
 		dev_err(dev, "invalid EPs\n");
 		return -EINVAL;
 	}
@@ -480,7 +492,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 	init_waitqueue_head(&cdev->ep1_wait_queue);
 	init_waitqueue_head(&cdev->prepare_wait_queue);
 
-	if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
+	if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
 		return -EIO;
 
 	err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
@@ -530,7 +542,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 	return 0;
 
  err_kill_urb:
-	usb_kill_urb(&cdev->ep1_in_urb);
+	usb_kill_urb(cdev->ep1_in_urb);
 	return err;
 }
 
@@ -576,8 +588,8 @@ static void snd_disconnect(struct usb_interface *intf)
 #endif
 	snd_usb_caiaq_audio_disconnect(cdev);
 
-	usb_kill_urb(&cdev->ep1_in_urb);
-	usb_kill_urb(&cdev->midi_out_urb);
+	usb_kill_urb(cdev->ep1_in_urb);
+	usb_kill_urb(cdev->midi_out_urb);
 
 	snd_card_free_when_closed(card);
 }
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index 743eb0387b5f..1c6f34693fa8 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info;
 struct snd_usb_caiaqdev {
 	struct snd_usb_audio chip;
 
-	struct urb ep1_in_urb;
-	struct urb midi_out_urb;
+	struct urb *ep1_in_urb;
+	struct urb *midi_out_urb;
 	struct urb **data_urbs_in;
 	struct urb **data_urbs_out;
 	struct snd_usb_caiaq_cb_info *data_cb_info;
diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
index c656d0162432..18529484c8dc 100644
--- a/sound/usb/caiaq/midi.c
+++ b/sound/usb/caiaq/midi.c
@@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre
 {
 	struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data;
 	if (cdev->midi_out_active) {
-		usb_kill_urb(&cdev->midi_out_urb);
+		usb_kill_urb(cdev->midi_out_urb);
 		cdev->midi_out_active = 0;
 	}
 	return 0;
@@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev,
 		return;
 
 	cdev->midi_out_buf[2] = len;
-	cdev->midi_out_urb.transfer_buffer_length = len+3;
+	cdev->midi_out_urb->transfer_buffer_length = len+3;
 
-	ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC);
+	ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC);
 	if (ret < 0)
 		dev_err(dev,
 			"snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"
-- 
2.43.0

Re: DIY allocation or embedding of URBs in larger structures

[Takashi Iwai]

On Thu, 03 Sep 2026 13:07:57 +0200,
Michal Pecio wrote:
> 
> On Thu, 03 Sep 2026 11:44:45 +0200, Takashi Iwai wrote:
> > On Thu, 03 Sep 2026 11:24:17 +0200,
> > Michal Pecio wrote:
> > > So what happens here is that USB core continues to use a URB after
> > > completion to implement things like usb_kill_urb(), so URBs are
> > > reference counted. Then core decrements the count - one more use.
> > > 
> > > If a driver waits for completion or even usb_kill_urb() to return
> > > and then proceeds to free the URB's storage, this becomes a UAF.
> > > This driver embeds 2 URBs in its priv and does just that.
> > > 
> > > A URB can only exist as an independent allocation, core will free
> > > it if upon finding zero reference count in such case.
> >
> > So, IIUC, now the URB *must* be always allocated via usb_alloc_urb()
> > and an embedded URB isn't allowed?  If so, we'd need to address other
> > drivers, too.
> 
> Yes, that's basically the case and actually has been for a long time.
> 
> The only thing that works is for both USB and the driver to call
> usb_free_urb() and whoever does last will actually free the storage.
> This means URB can't share storage with anything else.
> 
> Some drivers got away with making URB the first member of a struct
> which is freed together with it. AFAIK this pattern doesn't crash, but
> it's deprecated too because it puts a flexible member (in the URB) in
> the middle of (the outer) struct.
> 
> This pattern here in caiaq has always been one race away from UAF.
> Maybe it wasn't very likely to happen, but stuff like PREEMPT_RT and
> hypervisors can insert unexpected delays anywhere these days.
> 
> Greg KH puts it thusly:
> https://lore.kernel.org/linux-usb/2025120716-sway-hypnotic-8cb6@gregkh/

OK, I'll send the fix patches for the rest of sound drivers.


thanks,

Takashi