* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb
[not found] <6a6e9502.f794c993.27aeb.0018.GAE@google.com>
@ 2026-09-02 5:09 ` syzbot
2026-09-03 8:47 ` [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev Edward Adam Davis
2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio
0 siblings, 2 replies; 15+ messages in thread
From: syzbot @ 2026-09-02 5:09 UTC (permalink / raw)
To: bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb,
mchehab, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30
dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz
kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
usb 1-1: received EP1 urb->status = -2
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline]
BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline]
BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline]
BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline]
BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
__refcount_sub_and_test include/linux/refcount.h:389 [inline]
__refcount_dec_and_test include/linux/refcount.h:432 [inline]
refcount_dec_and_test include/linux/refcount.h:450 [inline]
kref_put include/linux/kref.h:64 [inline]
usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
run_ktimerd+0x6a/0x100 kernel/softirq.c:1183
smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 36:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5414 [inline]
__kmalloc_noprof+0x41d/0x790 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
snd_card_new+0x7b/0x110 sound/core/init.c:184
create_card sound/usb/caiaq/device.c:429 [inline]
snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3776
usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3776
usb_new_device+0x99a/0x1680 drivers/usb/core/hub.c:2708
hub_port_connect drivers/usb/core/hub.c:5580 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
port_event drivers/usb/core/hub.c:5884 [inline]
hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5966
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 36:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2748 [inline]
slab_free mm/slub.c:6499 [inline]
kfree+0x1c5/0x6d0 mm/slub.c:6792
device_release+0xc4/0x1f0 drivers/base/core.c:-1
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x222/0x550 lib/kobject.c:737
snd_card_free_when_closed sound/core/init.c:630 [inline]
snd_card_free+0x138/0x1d0 sound/core/init.c:662
snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3776
usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3776
usb_new_device+0x99a/0x1680 drivers/usb/core/hub.c:2708
hub_port_connect drivers/usb/core/hub.c:5580 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
port_event drivers/usb/core/hub.c:5884 [inline]
hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5966
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff88803cee0000
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 4176 bytes inside of
freed 8192-byte region [ffff88803cee0000, ffff88803cee2000)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3cee0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x80000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000040 ffff88813ff00280 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
head: 0080000000000040 ffff88813ff00280 dead000000000122 0000000000000000
head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5616, tgid 5616 (syz-executor411), ts 97458631629
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
prep_new_page mm/page_alloc.c:1879 [inline]
get_page_from_freelist+0x2591/0x2600 mm/page_alloc.c:3943
__alloc_frozen_pages_noprof+0x230/0x5c0 mm/page_alloc.c:5436
alloc_slab_page mm/slub.c:3347 [inline]
allocate_slab+0x7d/0x620 mm/slub.c:3462
new_slab mm/slub.c:3513 [inline]
refill_objects+0x2d8/0x350 mm/slub.c:7410
refill_sheaf mm/slub.c:2885 [inline]
__pcs_replace_empty_main+0x339/0x690 mm/slub.c:4774
alloc_from_pcs mm/slub.c:4850 [inline]
slab_alloc_node mm/slub.c:4984 [inline]
__kmalloc_cache_noprof+0x46f/0x680 mm/slub.c:5559
_kmalloc_noprof include/linux/slab.h:991 [inline]
usb_device_dump+0xd0/0x2200 drivers/usb/core/devices.c:412
usb_device_read+0x1b4/0x2c0 drivers/usb/core/devices.c:530
full_proxy_read+0x127/0x1f0 fs/debugfs/file.c:379
vfs_read+0x219/0xa90 fs/read_write.c:572
ksys_read+0x156/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5598 tgid 5598 ts 96447293579 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1418 [inline]
__free_frozen_pages+0xf8e/0x1070 mm/page_alloc.c:2962
__slab_free+0x250/0x2a0 mm/slub.c:5815
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4683 [inline]
slab_alloc_node mm/slub.c:4996 [inline]
__kmalloc_cache_noprof+0x353/0x680 mm/slub.c:5559
_kmalloc_noprof include/linux/slab.h:991 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
kernfs_fop_open+0x3a7/0xcf0 fs/kernfs/file.c:634
do_dentry_open+0x849/0x1420 fs/open.c:996
vfs_open+0x3b/0x350 fs/open.c:1101
do_open fs/namei.c:4837 [inline]
path_openat+0x1448/0x1d60 fs/namei.c:5000
do_file_open+0x23e/0x4a0 fs/namei.c:5029
do_sys_openat2+0x115/0x200 fs/open.c:1417
do_sys_open fs/open.c:1423 [inline]
__do_sys_openat fs/open.c:1439 [inline]
__se_sys_openat fs/open.c:1434 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1434
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88803cee0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88803cee0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88803cee1000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88803cee1080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88803cee1100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 15+ messages in thread
* [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
2026-09-02 5:09 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb syzbot
@ 2026-09-03 8:47 ` Edward Adam Davis
2026-09-03 9:32 ` Takashi Iwai
2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio
1 sibling, 1 reply; 15+ messages in thread
From: Edward Adam Davis @ 2026-09-03 8:47 UTC (permalink / raw)
To: syzbot+832ce9fa3face1b7d44d
Cc: zonque, perex, tiwai, daniel, linux-sound, gregkh, linux-kernel,
linux-usb, syzkaller-bugs
The epq_in_urb object belonging to the caiaq device is coupled within
the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
executes successfully, epq_in_urb is successfully added to the urbp_list
queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
layer driver for the caiaq USB device).
When init_card() calls snd_usb_caiaq_send_command() which subsequently
fails due to a timeout, and proceeds to call snd_card_free() to release
the card, the embedded ep1_in_urb object is also freed. When the dummy
HCD driver detects that the URB has been unlinked, it returns the URB
(by usb_hcd_giveback_urb()), which triggers [1].
Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
to using a pointer instead. Separately allocate and manage the memory for
ep1_in_urb to prevent the release of the snd_card memory object from
interfering with it.
[1]
BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
Call Trace:
usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
Allocated by task 36:
snd_card_new+0x7b/0x110 sound/core/init.c:184
create_card sound/usb/caiaq/device.c:429 [inline]
snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
Freed by task 36:
snd_card_free_when_closed sound/core/init.c:630 [inline]
snd_card_free+0x138/0x1d0 sound/core/init.c:662
snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
sound/usb/caiaq/device.c | 19 +++++++++++--------
sound/usb/caiaq/device.h | 2 +-
2 files changed, 12 insertions(+), 9 deletions(-)
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index a16e59248480..138b58914f1c 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
break;
}
- cdev->ep1_in_urb.actual_length = 0;
- ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
+ cdev->ep1_in_urb->actual_length = 0;
+ ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
if (ret < 0)
dev_err(dev, "unable to submit urb. OOM!?\n");
}
@@ -408,6 +408,8 @@ static void card_free(struct snd_card *card)
#endif
snd_usb_caiaq_audio_free(cdev);
usb_put_dev(cdev->chip.dev);
+ usb_free_urb(cdev->ep1_in_urb);
+ cdev->ep1_in_urb = NULL;
}
static int create_card(struct usb_device *usb_dev,
@@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
return -EIO;
}
- usb_init_urb(&cdev->ep1_in_urb);
+ cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+ usb_init_urb(cdev->ep1_in_urb);
usb_init_urb(&cdev->midi_out_urb);
- usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
+ usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
usb_rcvbulkpipe(usb_dev, 0x1),
cdev->ep1_in_buf, EP1_BUFSIZE,
usb_ep1_command_reply_dispatch, cdev);
@@ -471,7 +474,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
snd_usb_caiaq_midi_output_done, cdev);
/* sanity checks of EPs before actually submitting */
- if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
+ if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
usb_urb_ep_type_check(&cdev->midi_out_urb)) {
dev_err(dev, "invalid EPs\n");
return -EINVAL;
@@ -480,7 +483,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
init_waitqueue_head(&cdev->ep1_wait_queue);
init_waitqueue_head(&cdev->prepare_wait_queue);
- if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
+ if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
return -EIO;
err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
@@ -530,7 +533,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
return 0;
err_kill_urb:
- usb_kill_urb(&cdev->ep1_in_urb);
+ usb_kill_urb(cdev->ep1_in_urb);
return err;
}
@@ -576,7 +579,7 @@ static void snd_disconnect(struct usb_interface *intf)
#endif
snd_usb_caiaq_audio_disconnect(cdev);
- usb_kill_urb(&cdev->ep1_in_urb);
+ usb_kill_urb(cdev->ep1_in_urb);
usb_kill_urb(&cdev->midi_out_urb);
snd_card_free_when_closed(card);
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index 743eb0387b5f..a5f7dada25d8 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -60,7 +60,7 @@ struct snd_usb_caiaq_cb_info;
struct snd_usb_caiaqdev {
struct snd_usb_audio chip;
- struct urb ep1_in_urb;
+ struct urb *ep1_in_urb;
struct urb midi_out_urb;
struct urb **data_urbs_in;
struct urb **data_urbs_out;
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb
2026-09-02 5:09 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb syzbot
2026-09-03 8:47 ` [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev Edward Adam Davis
@ 2026-09-03 9:24 ` Michal Pecio
2026-09-03 9:44 ` Takashi Iwai
` (2 more replies)
1 sibling, 3 replies; 15+ messages in thread
From: Michal Pecio @ 2026-09-03 9:24 UTC (permalink / raw)
To: syzbot
Cc: bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb,
mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai, linux-sound
On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30
> dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
>
> usb 1-1: received EP1 urb->status = -2
> ==================================================================
> BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
> BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
> BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline]
> BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline]
> BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline]
> BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline]
> BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
>
> CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> Call Trace:
> <TASK>
> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
> print_address_description+0x55/0x1e0 mm/kasan/report.c:378
> print_report+0x58/0x70 mm/kasan/report.c:482
> kasan_report+0x117/0x150 mm/kasan/report.c:595
> check_region_inline mm/kasan/generic.c:-1 [inline]
> kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
> instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
> atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
> __refcount_sub_and_test include/linux/refcount.h:389 [inline]
> __refcount_dec_and_test include/linux/refcount.h:432 [inline]
> refcount_dec_and_test include/linux/refcount.h:450 [inline]
> kref_put include/linux/kref.h:64 [inline]
> usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
> __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
> __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
> hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
> handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
> __do_softirq kernel/softirq.c:679 [inline]
> run_ktimerd+0x6a/0x100 kernel/softirq.c:1183
> smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
> kthread+0x38b/0x470 kernel/kthread.c:436
> ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
[Adding sound people]
So what happens here is that USB core continues to use a URB after
completion to implement things like usb_kill_urb(), so URBs are
reference counted. Then core decrements the count - one more use.
If a driver waits for completion or even usb_kill_urb() to return
and then proceeds to free the URB's storage, this becomes a UAF.
This driver embeds 2 URBs in its priv and does just that.
A URB can only exist as an independent allocation, core will free
it if upon finding zero reference count in such case.
This is a mechanical conversion, untested. I don't have the HW.
#syz test
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index a16e59248480..3587794207d4 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -192,8 +192,7 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
break;
}
- cdev->ep1_in_urb.actual_length = 0;
- ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
+ ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
if (ret < 0)
dev_err(dev, "unable to submit urb. OOM!?\n");
}
@@ -403,6 +402,8 @@ static void card_free(struct snd_card *card)
{
struct snd_usb_caiaqdev *cdev = caiaqdev(card);
+ usb_free_urb(cdev->ep1_in_urb);
+ usb_free_urb(cdev->midi_out_urb);
#ifdef CONFIG_SND_USB_CAIAQ_INPUT
snd_usb_caiaq_input_free(cdev);
#endif
@@ -457,22 +458,24 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
return -EIO;
}
- usb_init_urb(&cdev->ep1_in_urb);
- usb_init_urb(&cdev->midi_out_urb);
+ cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+ cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!cdev->ep1_in_urb || !cdev->midi_out_urb)
+ return -ENOMEM;
- usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
+ usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
usb_rcvbulkpipe(usb_dev, 0x1),
cdev->ep1_in_buf, EP1_BUFSIZE,
usb_ep1_command_reply_dispatch, cdev);
- usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
+ usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev,
usb_sndbulkpipe(usb_dev, 0x1),
cdev->midi_out_buf, EP1_BUFSIZE,
snd_usb_caiaq_midi_output_done, cdev);
/* sanity checks of EPs before actually submitting */
- if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
- usb_urb_ep_type_check(&cdev->midi_out_urb)) {
+ if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
+ usb_urb_ep_type_check(cdev->midi_out_urb)) {
dev_err(dev, "invalid EPs\n");
return -EINVAL;
}
@@ -480,7 +483,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
init_waitqueue_head(&cdev->ep1_wait_queue);
init_waitqueue_head(&cdev->prepare_wait_queue);
- if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
+ if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
return -EIO;
err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
@@ -530,7 +533,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
return 0;
err_kill_urb:
- usb_kill_urb(&cdev->ep1_in_urb);
+ usb_kill_urb(cdev->ep1_in_urb);
return err;
}
@@ -576,8 +579,8 @@ static void snd_disconnect(struct usb_interface *intf)
#endif
snd_usb_caiaq_audio_disconnect(cdev);
- usb_kill_urb(&cdev->ep1_in_urb);
- usb_kill_urb(&cdev->midi_out_urb);
+ usb_kill_urb(cdev->ep1_in_urb);
+ usb_kill_urb(cdev->midi_out_urb);
snd_card_free_when_closed(card);
}
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index 743eb0387b5f..1c6f34693fa8 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info;
struct snd_usb_caiaqdev {
struct snd_usb_audio chip;
- struct urb ep1_in_urb;
- struct urb midi_out_urb;
+ struct urb *ep1_in_urb;
+ struct urb *midi_out_urb;
struct urb **data_urbs_in;
struct urb **data_urbs_out;
struct snd_usb_caiaq_cb_info *data_cb_info;
diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
index c656d0162432..18529484c8dc 100644
--- a/sound/usb/caiaq/midi.c
+++ b/sound/usb/caiaq/midi.c
@@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre
{
struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data;
if (cdev->midi_out_active) {
- usb_kill_urb(&cdev->midi_out_urb);
+ usb_kill_urb(cdev->midi_out_urb);
cdev->midi_out_active = 0;
}
return 0;
@@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev,
return;
cdev->midi_out_buf[2] = len;
- cdev->midi_out_urb.transfer_buffer_length = len+3;
+ cdev->midi_out_urb->transfer_buffer_length = len+3;
- ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC);
+ ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC);
if (ret < 0)
dev_err(dev,
"snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"
^ permalink raw reply related [flat|nested] 15+ messages in thread
* Re: [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
2026-09-03 8:47 ` [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev Edward Adam Davis
@ 2026-09-03 9:32 ` Takashi Iwai
2026-09-03 9:41 ` Edward Adam Davis
0 siblings, 1 reply; 15+ messages in thread
From: Takashi Iwai @ 2026-09-03 9:32 UTC (permalink / raw)
To: Edward Adam Davis
Cc: syzbot+832ce9fa3face1b7d44d, zonque, perex, tiwai, daniel,
linux-sound, gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Thu, 03 Sep 2026 10:47:47 +0200,
Edward Adam Davis wrote:
>
> The epq_in_urb object belonging to the caiaq device is coupled within
> the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
> executes successfully, epq_in_urb is successfully added to the urbp_list
> queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
> layer driver for the caiaq USB device).
>
> When init_card() calls snd_usb_caiaq_send_command() which subsequently
> fails due to a timeout, and proceeds to call snd_card_free() to release
> the card, the embedded ep1_in_urb object is also freed. When the dummy
> HCD driver detects that the URB has been unlinked, it returns the URB
> (by usb_hcd_giveback_urb()), which triggers [1].
>
> Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
> to using a pointer instead. Separately allocate and manage the memory for
> ep1_in_urb to prevent the release of the snd_card memory object from
> interfering with it.
>
> [1]
> BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> Call Trace:
> usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
> __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
> __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
> hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
>
> Allocated by task 36:
> snd_card_new+0x7b/0x110 sound/core/init.c:184
> create_card sound/usb/caiaq/device.c:429 [inline]
> snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
>
> Freed by task 36:
> snd_card_free_when_closed sound/core/init.c:630 [inline]
> snd_card_free+0x138/0x1d0 sound/core/init.c:662
> snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
>
> Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
> Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> ---
> sound/usb/caiaq/device.c | 19 +++++++++++--------
> sound/usb/caiaq/device.h | 2 +-
> 2 files changed, 12 insertions(+), 9 deletions(-)
>
> diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
> index a16e59248480..138b58914f1c 100644
> --- a/sound/usb/caiaq/device.c
> +++ b/sound/usb/caiaq/device.c
> @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
> break;
> }
>
> - cdev->ep1_in_urb.actual_length = 0;
> - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
> + cdev->ep1_in_urb->actual_length = 0;
> + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
> if (ret < 0)
> dev_err(dev, "unable to submit urb. OOM!?\n");
> }
> @@ -408,6 +408,8 @@ static void card_free(struct snd_card *card)
> #endif
> snd_usb_caiaq_audio_free(cdev);
> usb_put_dev(cdev->chip.dev);
> + usb_free_urb(cdev->ep1_in_urb);
> + cdev->ep1_in_urb = NULL;
> }
>
> static int create_card(struct usb_device *usb_dev,
> @@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
> return -EIO;
> }
>
> - usb_init_urb(&cdev->ep1_in_urb);
> + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
> + usb_init_urb(cdev->ep1_in_urb);
The error check is missing here, as sashiko review pointed out.
Could you fix and resubmit?
(The other issues reported there -- the potential-double-free and the
midi_out_urb handling can be skipped here; I'll fix those
individually.)
thanks,
Takashi
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
2026-09-03 9:32 ` Takashi Iwai
@ 2026-09-03 9:41 ` Edward Adam Davis
2026-09-03 10:03 ` Takashi Iwai
2026-09-03 10:04 ` [PATCH v2] " Edward Adam Davis
0 siblings, 2 replies; 15+ messages in thread
From: Edward Adam Davis @ 2026-09-03 9:41 UTC (permalink / raw)
To: tiwai
Cc: daniel, eadavis, gregkh, linux-kernel, linux-sound, linux-usb,
perex, syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, zonque
From: Edward Aadm Davis <eadavis@sina.com>
On Thu, 03 Sep 2026 11:32:22 +0200, Takashi Iwai wrote:
> > The epq_in_urb object belonging to the caiaq device is coupled within
> > the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
> > executes successfully, epq_in_urb is successfully added to the urbp_list
> > queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
> > layer driver for the caiaq USB device).
> >
> > When init_card() calls snd_usb_caiaq_send_command() which subsequently
> > fails due to a timeout, and proceeds to call snd_card_free() to release
> > the card, the embedded ep1_in_urb object is also freed. When the dummy
> > HCD driver detects that the URB has been unlinked, it returns the URB
> > (by usb_hcd_giveback_urb()), which triggers [1].
> >
> > Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
> > to using a pointer instead. Separately allocate and manage the memory for
> > ep1_in_urb to prevent the release of the snd_card memory object from
> > interfering with it.
> >
> > [1]
> > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> > Call Trace:
> > usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> > dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
> > __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
> > __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
> > hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
> >
> > Allocated by task 36:
> > snd_card_new+0x7b/0x110 sound/core/init.c:184
> > create_card sound/usb/caiaq/device.c:429 [inline]
> > snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
> >
> > Freed by task 36:
> > snd_card_free_when_closed sound/core/init.c:630 [inline]
> > snd_card_free+0x138/0x1d0 sound/core/init.c:662
> > snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
> >
> > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> > Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
> > Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> > Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> > Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> > ---
> > sound/usb/caiaq/device.c | 19 +++++++++++--------
> > sound/usb/caiaq/device.h | 2 +-
> > 2 files changed, 12 insertions(+), 9 deletions(-)
> >
> > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
> > index a16e59248480..138b58914f1c 100644
> > --- a/sound/usb/caiaq/device.c
> > +++ b/sound/usb/caiaq/device.c
> > @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
> > break;
> > }
> >
> > - cdev->ep1_in_urb.actual_length = 0;
> > - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
> > + cdev->ep1_in_urb->actual_length = 0;
> > + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
> > if (ret < 0)
> > dev_err(dev, "unable to submit urb. OOM!?\n");
> > }
> > @@ -408,6 +408,8 @@ static void card_free(struct snd_card *card)
> > #endif
> > snd_usb_caiaq_audio_free(cdev);
> > usb_put_dev(cdev->chip.dev);
> > + usb_free_urb(cdev->ep1_in_urb);
> > + cdev->ep1_in_urb = NULL;
> > }
> >
> > static int create_card(struct usb_device *usb_dev,
> > @@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
> > return -EIO;
> > }
> >
> > - usb_init_urb(&cdev->ep1_in_urb);
> > + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
> > + usb_init_urb(cdev->ep1_in_urb);
>
> The error check is missing here, as sashiko review pointed out.
> Could you fix and resubmit?
OK. I will fix and resubmit.
>
> (The other issues reported there -- the potential-double-free and the
> midi_out_urb handling can be skipped here; I'll fix those
> individually.)
I can handle `midi_out_urb` as well.
BR,
Edward
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb
2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio
@ 2026-09-03 9:44 ` Takashi Iwai
2026-09-03 11:07 ` DIY allocation or embedding of URBs in larger structures Michal Pecio
2026-09-03 9:55 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Hillf Danton
2026-09-03 10:01 ` syzbot
2 siblings, 1 reply; 15+ messages in thread
From: Takashi Iwai @ 2026-09-03 9:44 UTC (permalink / raw)
To: Michal Pecio
Cc: syzbot, bolewara, devnull, gregkh, linux-kernel, linux-media,
linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai,
linux-sound
On Thu, 03 Sep 2026 11:24:17 +0200,
Michal Pecio wrote:
>
> On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote:
> > syzbot has found a reproducer for the following issue on:
> >
> > HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:..
> > git tree: upstream
> > console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30
> > dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> > compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> >
> > usb 1-1: received EP1 urb->status = -2
> > ==================================================================
> > BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
> > BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
> > BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline]
> > BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline]
> > BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline]
> > BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline]
> > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> >
> > CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> > Call Trace:
> > <TASK>
> > dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
> > print_address_description+0x55/0x1e0 mm/kasan/report.c:378
> > print_report+0x58/0x70 mm/kasan/report.c:482
> > kasan_report+0x117/0x150 mm/kasan/report.c:595
> > check_region_inline mm/kasan/generic.c:-1 [inline]
> > kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
> > instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
> > atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
> > __refcount_sub_and_test include/linux/refcount.h:389 [inline]
> > __refcount_dec_and_test include/linux/refcount.h:432 [inline]
> > refcount_dec_and_test include/linux/refcount.h:450 [inline]
> > kref_put include/linux/kref.h:64 [inline]
> > usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> > dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
> > __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
> > __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
> > hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
> > handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
> > __do_softirq kernel/softirq.c:679 [inline]
> > run_ktimerd+0x6a/0x100 kernel/softirq.c:1183
> > smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
> > kthread+0x38b/0x470 kernel/kthread.c:436
> > ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> > </TASK>
>
> [Adding sound people]
>
> So what happens here is that USB core continues to use a URB after
> completion to implement things like usb_kill_urb(), so URBs are
> reference counted. Then core decrements the count - one more use.
>
> If a driver waits for completion or even usb_kill_urb() to return
> and then proceeds to free the URB's storage, this becomes a UAF.
> This driver embeds 2 URBs in its priv and does just that.
>
> A URB can only exist as an independent allocation, core will free
> it if upon finding zero reference count in such case.
>
> This is a mechanical conversion, untested. I don't have the HW.
This should work, and we've received another similar patch submission
already.
So, IIUC, now the URB *must* be always allocated via usb_alloc_urb()
and an embedded URB isn't allowed? If so, we'd need to address other
drivers, too.
thanks,
Takashi
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb
2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio
2026-09-03 9:44 ` Takashi Iwai
@ 2026-09-03 9:55 ` Hillf Danton
2026-09-03 10:01 ` syzbot
2 siblings, 0 replies; 15+ messages in thread
From: Hillf Danton @ 2026-09-03 9:55 UTC (permalink / raw)
To: Michal Pecio
Cc: syzbot, linux-media, linux-usb, mchehab, syzkaller-bugs,
Daniel Mack, Takashi Iwai, linux-sound
On Thu, 3 Sep 2026 11:24:17 +0200 Michal Pecio wrote:
>On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote:
>> syzbot has found a reproducer for the following issue on:
>>
>> HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:..
>> git tree: upstream
>> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30
>> dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
>> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
>>
>> usb 1-1: received EP1 urb->status = -2
>> ==================================================================
>> BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
>> BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
>> BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline]
>> BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline]
>> BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline]
>> BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline]
>> BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
>> Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
>>
>> CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
>> Call Trace:
>> <TASK>
>> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
>> print_address_description+0x55/0x1e0 mm/kasan/report.c:378
>> print_report+0x58/0x70 mm/kasan/report.c:482
>> kasan_report+0x117/0x150 mm/kasan/report.c:595
>> check_region_inline mm/kasan/generic.c:-1 [inline]
>> kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
>> instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
>> atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
>> __refcount_sub_and_test include/linux/refcount.h:389 [inline]
>> __refcount_dec_and_test include/linux/refcount.h:432 [inline]
>> refcount_dec_and_test include/linux/refcount.h:450 [inline]
>> kref_put include/linux/kref.h:64 [inline]
>> usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
>> dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
>> __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
>> __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
>> hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
>> handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
>> __do_softirq kernel/softirq.c:679 [inline]
>> run_ktimerd+0x6a/0x100 kernel/softirq.c:1183
>> smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
>> kthread+0x38b/0x470 kernel/kthread.c:436
>> ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
>> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>> </TASK>
>
>[Adding sound people]
>
> So what happens here is that USB core continues to use a URB after
> completion to implement things like usb_kill_urb(), so URBs are
> reference counted. Then core decrements the count - one more use.
>
> If a driver waits for completion or even usb_kill_urb() to return
> and then proceeds to free the URB's storage, this becomes a UAF.
> This driver embeds 2 URBs in its priv and does just that.
>
Given dummy_urb_dequeue(), the dequeued urb should be tagged not to
be handled again in the dummy_timer callback instead, just my $0.02
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb
2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio
2026-09-03 9:44 ` Takashi Iwai
2026-09-03 9:55 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Hillf Danton
@ 2026-09-03 10:01 ` syzbot
2 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2026-09-03 10:01 UTC (permalink / raw)
To: bolewara, devnull, gregkh, linux-kernel, linux-media, linux-sound,
linux-usb, mchehab, michal.pecio, syzkaller-bugs, tiwai, zonque
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Tested on:
commit: 940de590 Merge tag 'hardening-v7.3-rc2' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13da7c15580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30
dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=15527c15580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
2026-09-03 9:41 ` Edward Adam Davis
@ 2026-09-03 10:03 ` Takashi Iwai
2026-09-03 11:56 ` [PATCH v3] " Edward Adam Davis
2026-09-03 10:04 ` [PATCH v2] " Edward Adam Davis
1 sibling, 1 reply; 15+ messages in thread
From: Takashi Iwai @ 2026-09-03 10:03 UTC (permalink / raw)
To: Edward Adam Davis
Cc: tiwai, daniel, gregkh, linux-kernel, linux-sound, linux-usb,
perex, syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, zonque
On Thu, 03 Sep 2026 11:41:05 +0200,
Edward Adam Davis wrote:
>
> From: Edward Aadm Davis <eadavis@sina.com>
>
> On Thu, 03 Sep 2026 11:32:22 +0200, Takashi Iwai wrote:
> > > The epq_in_urb object belonging to the caiaq device is coupled within
> > > the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
> > > executes successfully, epq_in_urb is successfully added to the urbp_list
> > > queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
> > > layer driver for the caiaq USB device).
> > >
> > > When init_card() calls snd_usb_caiaq_send_command() which subsequently
> > > fails due to a timeout, and proceeds to call snd_card_free() to release
> > > the card, the embedded ep1_in_urb object is also freed. When the dummy
> > > HCD driver detects that the URB has been unlinked, it returns the URB
> > > (by usb_hcd_giveback_urb()), which triggers [1].
> > >
> > > Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
> > > to using a pointer instead. Separately allocate and manage the memory for
> > > ep1_in_urb to prevent the release of the snd_card memory object from
> > > interfering with it.
> > >
> > > [1]
> > > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> > > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> > > Call Trace:
> > > usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> > > dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
> > > __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
> > > __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
> > > hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
> > >
> > > Allocated by task 36:
> > > snd_card_new+0x7b/0x110 sound/core/init.c:184
> > > create_card sound/usb/caiaq/device.c:429 [inline]
> > > snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
> > >
> > > Freed by task 36:
> > > snd_card_free_when_closed sound/core/init.c:630 [inline]
> > > snd_card_free+0x138/0x1d0 sound/core/init.c:662
> > > snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
> > >
> > > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> > > Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
> > > Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> > > Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> > > Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> > > ---
> > > sound/usb/caiaq/device.c | 19 +++++++++++--------
> > > sound/usb/caiaq/device.h | 2 +-
> > > 2 files changed, 12 insertions(+), 9 deletions(-)
> > >
> > > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
> > > index a16e59248480..138b58914f1c 100644
> > > --- a/sound/usb/caiaq/device.c
> > > +++ b/sound/usb/caiaq/device.c
> > > @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
> > > break;
> > > }
> > >
> > > - cdev->ep1_in_urb.actual_length = 0;
> > > - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
> > > + cdev->ep1_in_urb->actual_length = 0;
> > > + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
> > > if (ret < 0)
> > > dev_err(dev, "unable to submit urb. OOM!?\n");
> > > }
> > > @@ -408,6 +408,8 @@ static void card_free(struct snd_card *card)
> > > #endif
> > > snd_usb_caiaq_audio_free(cdev);
> > > usb_put_dev(cdev->chip.dev);
> > > + usb_free_urb(cdev->ep1_in_urb);
> > > + cdev->ep1_in_urb = NULL;
> > > }
> > >
> > > static int create_card(struct usb_device *usb_dev,
> > > @@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
> > > return -EIO;
> > > }
> > >
> > > - usb_init_urb(&cdev->ep1_in_urb);
> > > + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
> > > + usb_init_urb(cdev->ep1_in_urb);
> >
> > The error check is missing here, as sashiko review pointed out.
> > Could you fix and resubmit?
> OK. I will fix and resubmit.
> >
> > (The other issues reported there -- the potential-double-free and the
> > midi_out_urb handling can be skipped here; I'll fix those
> > individually.)
> I can handle `midi_out_urb` as well.
OK, then let's shoot both URBs in a shot.
thanks,
Takashi
^ permalink raw reply [flat|nested] 15+ messages in thread
* [PATCH v2] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
2026-09-03 9:41 ` Edward Adam Davis
2026-09-03 10:03 ` Takashi Iwai
@ 2026-09-03 10:04 ` Edward Adam Davis
2026-09-03 11:34 ` Michal Pecio
1 sibling, 1 reply; 15+ messages in thread
From: Edward Adam Davis @ 2026-09-03 10:04 UTC (permalink / raw)
To: eadavis
Cc: daniel, gregkh, linux-kernel, linux-sound, linux-usb, perex,
syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, tiwai, zonque
The epq_in_urb object belonging to the caiaq device is coupled within
the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
executes successfully, epq_in_urb is successfully added to the urbp_list
queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
layer driver for the caiaq USB device).
When init_card() calls snd_usb_caiaq_send_command() which subsequently
fails due to a timeout, and proceeds to call snd_card_free() to release
the card, the embedded ep1_in_urb object is also freed. When the dummy
HCD driver detects that the URB has been unlinked, it returns the URB
(by usb_hcd_giveback_urb()), which triggers [1].
Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
to using a pointer instead. Separately allocate and manage the memory for
ep1_in_urb to prevent the release of the snd_card memory object from
interfering with it.
midi_out_urb has the same issue as ep1_in_urb and is handled in the same
way.
[1]
BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
Call Trace:
usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
Allocated by task 36:
snd_card_new+0x7b/0x110 sound/core/init.c:184
create_card sound/usb/caiaq/device.c:429 [inline]
snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
Freed by task 36:
snd_card_free_when_closed sound/core/init.c:630 [inline]
snd_card_free+0x138/0x1d0 sound/core/init.c:662
snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
v1 -> v2: same dealwith midi_out_urb and add missing check
sound/usb/caiaq/device.c | 39 +++++++++++++++++++++++++++------------
sound/usb/caiaq/device.h | 4 ++--
sound/usb/caiaq/midi.c | 6 +++---
3 files changed, 32 insertions(+), 17 deletions(-)
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index a16e59248480..d0fe954b8133 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
break;
}
- cdev->ep1_in_urb.actual_length = 0;
- ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
+ cdev->ep1_in_urb->actual_length = 0;
+ ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
if (ret < 0)
dev_err(dev, "unable to submit urb. OOM!?\n");
}
@@ -408,6 +408,10 @@ static void card_free(struct snd_card *card)
#endif
snd_usb_caiaq_audio_free(cdev);
usb_put_dev(cdev->chip.dev);
+ usb_free_urb(cdev->ep1_in_urb);
+ cdev->ep1_in_urb = NULL;
+ usb_free_urb(cdev->midi_out_urb);
+ cdev->midi_out_urb = NULL;
}
static int create_card(struct usb_device *usb_dev,
@@ -457,22 +461,33 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
return -EIO;
}
- usb_init_urb(&cdev->ep1_in_urb);
- usb_init_urb(&cdev->midi_out_urb);
+ cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!cdev->ep1_in_urb) {
+ dev_err(dev, "alloc ep1_in_urb failed.\n");
+ return -ENOMEM;
+ }
+ cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!cdev->midi_out_urb) {
+ usb_free_urb(cdev->ep1_in_urb);
+ dev_err(dev, "alloc midi_out_urb failed.\n");
+ return -ENOMEM;
+ }
+ usb_init_urb(cdev->ep1_in_urb);
+ usb_init_urb(cdev->midi_out_urb);
- usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
+ usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
usb_rcvbulkpipe(usb_dev, 0x1),
cdev->ep1_in_buf, EP1_BUFSIZE,
usb_ep1_command_reply_dispatch, cdev);
- usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
+ usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev,
usb_sndbulkpipe(usb_dev, 0x1),
cdev->midi_out_buf, EP1_BUFSIZE,
snd_usb_caiaq_midi_output_done, cdev);
/* sanity checks of EPs before actually submitting */
- if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
- usb_urb_ep_type_check(&cdev->midi_out_urb)) {
+ if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
+ usb_urb_ep_type_check(cdev->midi_out_urb)) {
dev_err(dev, "invalid EPs\n");
return -EINVAL;
}
@@ -480,7 +495,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
init_waitqueue_head(&cdev->ep1_wait_queue);
init_waitqueue_head(&cdev->prepare_wait_queue);
- if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
+ if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
return -EIO;
err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
@@ -530,7 +545,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
return 0;
err_kill_urb:
- usb_kill_urb(&cdev->ep1_in_urb);
+ usb_kill_urb(cdev->ep1_in_urb);
return err;
}
@@ -576,8 +591,8 @@ static void snd_disconnect(struct usb_interface *intf)
#endif
snd_usb_caiaq_audio_disconnect(cdev);
- usb_kill_urb(&cdev->ep1_in_urb);
- usb_kill_urb(&cdev->midi_out_urb);
+ usb_kill_urb(cdev->ep1_in_urb);
+ usb_kill_urb(cdev->midi_out_urb);
snd_card_free_when_closed(card);
}
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index 743eb0387b5f..1c6f34693fa8 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info;
struct snd_usb_caiaqdev {
struct snd_usb_audio chip;
- struct urb ep1_in_urb;
- struct urb midi_out_urb;
+ struct urb *ep1_in_urb;
+ struct urb *midi_out_urb;
struct urb **data_urbs_in;
struct urb **data_urbs_out;
struct snd_usb_caiaq_cb_info *data_cb_info;
diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
index c656d0162432..18529484c8dc 100644
--- a/sound/usb/caiaq/midi.c
+++ b/sound/usb/caiaq/midi.c
@@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre
{
struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data;
if (cdev->midi_out_active) {
- usb_kill_urb(&cdev->midi_out_urb);
+ usb_kill_urb(cdev->midi_out_urb);
cdev->midi_out_active = 0;
}
return 0;
@@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev,
return;
cdev->midi_out_buf[2] = len;
- cdev->midi_out_urb.transfer_buffer_length = len+3;
+ cdev->midi_out_urb->transfer_buffer_length = len+3;
- ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC);
+ ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC);
if (ret < 0)
dev_err(dev,
"snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread
* DIY allocation or embedding of URBs in larger structures
2026-09-03 9:44 ` Takashi Iwai
@ 2026-09-03 11:07 ` Michal Pecio
2026-09-03 14:37 ` Takashi Iwai
0 siblings, 1 reply; 15+ messages in thread
From: Michal Pecio @ 2026-09-03 11:07 UTC (permalink / raw)
To: Takashi Iwai
Cc: syzbot, bolewara, devnull, gregkh, linux-kernel, linux-media,
linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai,
linux-sound
On Thu, 03 Sep 2026 11:44:45 +0200, Takashi Iwai wrote:
> On Thu, 03 Sep 2026 11:24:17 +0200,
> Michal Pecio wrote:
> > So what happens here is that USB core continues to use a URB after
> > completion to implement things like usb_kill_urb(), so URBs are
> > reference counted. Then core decrements the count - one more use.
> >
> > If a driver waits for completion or even usb_kill_urb() to return
> > and then proceeds to free the URB's storage, this becomes a UAF.
> > This driver embeds 2 URBs in its priv and does just that.
> >
> > A URB can only exist as an independent allocation, core will free
> > it if upon finding zero reference count in such case.
>
> So, IIUC, now the URB *must* be always allocated via usb_alloc_urb()
> and an embedded URB isn't allowed? If so, we'd need to address other
> drivers, too.
Yes, that's basically the case and actually has been for a long time.
The only thing that works is for both USB and the driver to call
usb_free_urb() and whoever does last will actually free the storage.
This means URB can't share storage with anything else.
Some drivers got away with making URB the first member of a struct
which is freed together with it. AFAIK this pattern doesn't crash, but
it's deprecated too because it puts a flexible member (in the URB) in
the middle of (the outer) struct.
This pattern here in caiaq has always been one race away from UAF.
Maybe it wasn't very likely to happen, but stuff like PREEMPT_RT and
hypervisors can insert unexpected delays anywhere these days.
Greg KH puts it thusly:
https://lore.kernel.org/linux-usb/2025120716-sway-hypnotic-8cb6@gregkh/
Reragds,
Michal
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [PATCH v2] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
2026-09-03 10:04 ` [PATCH v2] " Edward Adam Davis
@ 2026-09-03 11:34 ` Michal Pecio
0 siblings, 0 replies; 15+ messages in thread
From: Michal Pecio @ 2026-09-03 11:34 UTC (permalink / raw)
To: Edward Adam Davis
Cc: daniel, gregkh, linux-kernel, linux-sound, linux-usb, perex,
syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, tiwai, zonque
On Thu, 3 Sep 2026 18:04:10 +0800, Edward Adam Davis wrote:
> The epq_in_urb object belonging to the caiaq device is coupled within
> the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
> executes successfully, epq_in_urb is successfully added to the urbp_list
> queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
> layer driver for the caiaq USB device).
Sounds like an irrelevant detail. Same crash would happen with any HCD.
> When init_card() calls snd_usb_caiaq_send_command() which subsequently
> fails due to a timeout, and proceeds to call snd_card_free() to release
> the card, the embedded ep1_in_urb object is also freed. When the dummy
> HCD driver detects that the URB has been unlinked, it returns the URB
> (by usb_hcd_giveback_urb()), which triggers [1].
>
> Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
> to using a pointer instead. Separately allocate and manage the memory for
> ep1_in_urb to prevent the release of the snd_card memory object from
> interfering with it.
>
> midi_out_urb has the same issue as ep1_in_urb and is handled in the same
> way.
>
> [1]
> BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
> Call Trace:
> usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
> dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
> __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
> __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
> hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
>
> Allocated by task 36:
> snd_card_new+0x7b/0x110 sound/core/init.c:184
> create_card sound/usb/caiaq/device.c:429 [inline]
> snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
>
> Freed by task 36:
> snd_card_free_when_closed sound/core/init.c:630 [inline]
> snd_card_free+0x138/0x1d0 sound/core/init.c:662
> snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
>
> Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
> Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
> Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> ---
Does this submission comply with the rules here?
https://docs.kernel.org/process/coding-assistants.html
> v1 -> v2: same dealwith midi_out_urb and add missing check
>
> sound/usb/caiaq/device.c | 39 +++++++++++++++++++++++++++------------
> sound/usb/caiaq/device.h | 4 ++--
> sound/usb/caiaq/midi.c | 6 +++---
> 3 files changed, 32 insertions(+), 17 deletions(-)
>
> diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
> index a16e59248480..d0fe954b8133 100644
> --- a/sound/usb/caiaq/device.c
> +++ b/sound/usb/caiaq/device.c
> @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
> break;
> }
>
> - cdev->ep1_in_urb.actual_length = 0;
> - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
> + cdev->ep1_in_urb->actual_length = 0;
That's one of the first things usb_submit_urb() below would do,
and has done since forever.
> + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
> if (ret < 0)
> dev_err(dev, "unable to submit urb. OOM!?\n");
> }
> @@ -408,6 +408,10 @@ static void card_free(struct snd_card *card)
> #endif
> snd_usb_caiaq_audio_free(cdev);
> usb_put_dev(cdev->chip.dev);
> + usb_free_urb(cdev->ep1_in_urb);
> + cdev->ep1_in_urb = NULL;
> + usb_free_urb(cdev->midi_out_urb);
> + cdev->midi_out_urb = NULL;
Is clearing this necessary? (I'm not familiar with ALSA)
> }
>
> static int create_card(struct usb_device *usb_dev,
> @@ -457,22 +461,33 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
> return -EIO;
> }
>
> - usb_init_urb(&cdev->ep1_in_urb);
> - usb_init_urb(&cdev->midi_out_urb);
> + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
> + if (!cdev->ep1_in_urb) {
> + dev_err(dev, "alloc ep1_in_urb failed.\n");
AFAIK logging on allocation failure is frowned upon.
> + return -ENOMEM;
> + }
> + cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL);
> + if (!cdev->midi_out_urb) {
> + usb_free_urb(cdev->ep1_in_urb);
> + dev_err(dev, "alloc midi_out_urb failed.\n");
> + return -ENOMEM;
> + }
> + usb_init_urb(cdev->ep1_in_urb);
> + usb_init_urb(cdev->midi_out_urb);
And what would be the point of that?
>
> - usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
> + usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
> usb_rcvbulkpipe(usb_dev, 0x1),
> cdev->ep1_in_buf, EP1_BUFSIZE,
> usb_ep1_command_reply_dispatch, cdev);
>
> - usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
> + usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev,
> usb_sndbulkpipe(usb_dev, 0x1),
> cdev->midi_out_buf, EP1_BUFSIZE,
> snd_usb_caiaq_midi_output_done, cdev);
>
> /* sanity checks of EPs before actually submitting */
> - if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
> - usb_urb_ep_type_check(&cdev->midi_out_urb)) {
> + if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
> + usb_urb_ep_type_check(cdev->midi_out_urb)) {
> dev_err(dev, "invalid EPs\n");
> return -EINVAL;
> }
> @@ -480,7 +495,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
> init_waitqueue_head(&cdev->ep1_wait_queue);
> init_waitqueue_head(&cdev->prepare_wait_queue);
>
> - if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
> + if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
> return -EIO;
>
> err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
> @@ -530,7 +545,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
> return 0;
>
> err_kill_urb:
> - usb_kill_urb(&cdev->ep1_in_urb);
> + usb_kill_urb(cdev->ep1_in_urb);
> return err;
> }
>
> @@ -576,8 +591,8 @@ static void snd_disconnect(struct usb_interface *intf)
> #endif
> snd_usb_caiaq_audio_disconnect(cdev);
>
> - usb_kill_urb(&cdev->ep1_in_urb);
> - usb_kill_urb(&cdev->midi_out_urb);
> + usb_kill_urb(cdev->ep1_in_urb);
> + usb_kill_urb(cdev->midi_out_urb);
>
> snd_card_free_when_closed(card);
> }
> diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
> index 743eb0387b5f..1c6f34693fa8 100644
> --- a/sound/usb/caiaq/device.h
> +++ b/sound/usb/caiaq/device.h
> @@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info;
> struct snd_usb_caiaqdev {
> struct snd_usb_audio chip;
>
> - struct urb ep1_in_urb;
> - struct urb midi_out_urb;
> + struct urb *ep1_in_urb;
> + struct urb *midi_out_urb;
> struct urb **data_urbs_in;
> struct urb **data_urbs_out;
> struct snd_usb_caiaq_cb_info *data_cb_info;
> diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
> index c656d0162432..18529484c8dc 100644
> --- a/sound/usb/caiaq/midi.c
> +++ b/sound/usb/caiaq/midi.c
> @@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre
> {
> struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data;
> if (cdev->midi_out_active) {
> - usb_kill_urb(&cdev->midi_out_urb);
> + usb_kill_urb(cdev->midi_out_urb);
> cdev->midi_out_active = 0;
> }
> return 0;
> @@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev,
> return;
>
> cdev->midi_out_buf[2] = len;
> - cdev->midi_out_urb.transfer_buffer_length = len+3;
> + cdev->midi_out_urb->transfer_buffer_length = len+3;
>
> - ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC);
> + ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC);
> if (ret < 0)
> dev_err(dev,
> "snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 15+ messages in thread
* [PATCH v3] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
2026-09-03 10:03 ` Takashi Iwai
@ 2026-09-03 11:56 ` Edward Adam Davis
2026-09-03 13:05 ` [PATCH v4] " Edward Adam Davis
0 siblings, 1 reply; 15+ messages in thread
From: Edward Adam Davis @ 2026-09-03 11:56 UTC (permalink / raw)
To: tiwai
Cc: daniel, eadavis, gregkh, linux-kernel, linux-sound, linux-usb,
perex, syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, zonque
The epq_in_urb object belonging to the caiaq device is coupled within
the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
executes successfully, epq_in_urb is successfully added to the urbp_list
queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
layer driver for the caiaq USB device).
When init_card() calls snd_usb_caiaq_send_command() which subsequently
fails due to a timeout, and proceeds to call snd_card_free() to release
the card, the embedded ep1_in_urb object is also freed. When the dummy
HCD driver detects that the URB has been unlinked, it returns the URB
(by usb_hcd_giveback_urb()), which triggers [1].
Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
to using a pointer instead. Separately allocate and manage the memory for
ep1_in_urb to prevent the release of the snd_card memory object from
interfering with it.
midi_out_urb has the same issue as ep1_in_urb and is handled in the same
way.
[1]
BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
Call Trace:
usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
Allocated by task 36:
snd_card_new+0x7b/0x110 sound/core/init.c:184
create_card sound/usb/caiaq/device.c:429 [inline]
snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
Freed by task 36:
snd_card_free_when_closed sound/core/init.c:630 [inline]
snd_card_free+0x138/0x1d0 sound/core/init.c:662
snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
v1 -> v2: same dealwith midi_out_urb and add missing check
v2 -> v3: set ep1_in_urb to NULL after midi_out_urb allow failed
remove err message when alloc failed
sound/usb/caiaq/device.c | 38 ++++++++++++++++++++++++++------------
sound/usb/caiaq/device.h | 4 ++--
sound/usb/caiaq/midi.c | 6 +++---
3 files changed, 31 insertions(+), 17 deletions(-)
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index a16e59248480..ff761978a1cf 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
break;
}
- cdev->ep1_in_urb.actual_length = 0;
- ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
+ cdev->ep1_in_urb->actual_length = 0;
+ ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
if (ret < 0)
dev_err(dev, "unable to submit urb. OOM!?\n");
}
@@ -408,6 +408,10 @@ static void card_free(struct snd_card *card)
#endif
snd_usb_caiaq_audio_free(cdev);
usb_put_dev(cdev->chip.dev);
+ usb_free_urb(cdev->ep1_in_urb);
+ cdev->ep1_in_urb = NULL;
+ usb_free_urb(cdev->midi_out_urb);
+ cdev->midi_out_urb = NULL;
}
static int create_card(struct usb_device *usb_dev,
@@ -457,22 +461,32 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
return -EIO;
}
- usb_init_urb(&cdev->ep1_in_urb);
- usb_init_urb(&cdev->midi_out_urb);
+ cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!cdev->ep1_in_urb)
+ return -ENOMEM;
- usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
+ cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!cdev->midi_out_urb) {
+ usb_free_urb(cdev->ep1_in_urb);
+ cdev->ep1_in_urb = NULL;
+ return -ENOMEM;
+ }
+ usb_init_urb(cdev->ep1_in_urb);
+ usb_init_urb(cdev->midi_out_urb);
+
+ usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
usb_rcvbulkpipe(usb_dev, 0x1),
cdev->ep1_in_buf, EP1_BUFSIZE,
usb_ep1_command_reply_dispatch, cdev);
- usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
+ usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev,
usb_sndbulkpipe(usb_dev, 0x1),
cdev->midi_out_buf, EP1_BUFSIZE,
snd_usb_caiaq_midi_output_done, cdev);
/* sanity checks of EPs before actually submitting */
- if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
- usb_urb_ep_type_check(&cdev->midi_out_urb)) {
+ if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
+ usb_urb_ep_type_check(cdev->midi_out_urb)) {
dev_err(dev, "invalid EPs\n");
return -EINVAL;
}
@@ -480,7 +494,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
init_waitqueue_head(&cdev->ep1_wait_queue);
init_waitqueue_head(&cdev->prepare_wait_queue);
- if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
+ if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
return -EIO;
err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
@@ -530,7 +544,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
return 0;
err_kill_urb:
- usb_kill_urb(&cdev->ep1_in_urb);
+ usb_kill_urb(cdev->ep1_in_urb);
return err;
}
@@ -576,8 +590,8 @@ static void snd_disconnect(struct usb_interface *intf)
#endif
snd_usb_caiaq_audio_disconnect(cdev);
- usb_kill_urb(&cdev->ep1_in_urb);
- usb_kill_urb(&cdev->midi_out_urb);
+ usb_kill_urb(cdev->ep1_in_urb);
+ usb_kill_urb(cdev->midi_out_urb);
snd_card_free_when_closed(card);
}
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index 743eb0387b5f..1c6f34693fa8 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info;
struct snd_usb_caiaqdev {
struct snd_usb_audio chip;
- struct urb ep1_in_urb;
- struct urb midi_out_urb;
+ struct urb *ep1_in_urb;
+ struct urb *midi_out_urb;
struct urb **data_urbs_in;
struct urb **data_urbs_out;
struct snd_usb_caiaq_cb_info *data_cb_info;
diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
index c656d0162432..18529484c8dc 100644
--- a/sound/usb/caiaq/midi.c
+++ b/sound/usb/caiaq/midi.c
@@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre
{
struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data;
if (cdev->midi_out_active) {
- usb_kill_urb(&cdev->midi_out_urb);
+ usb_kill_urb(cdev->midi_out_urb);
cdev->midi_out_active = 0;
}
return 0;
@@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev,
return;
cdev->midi_out_buf[2] = len;
- cdev->midi_out_urb.transfer_buffer_length = len+3;
+ cdev->midi_out_urb->transfer_buffer_length = len+3;
- ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC);
+ ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC);
if (ret < 0)
dev_err(dev,
"snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread
* [PATCH v4] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
2026-09-03 11:56 ` [PATCH v3] " Edward Adam Davis
@ 2026-09-03 13:05 ` Edward Adam Davis
0 siblings, 0 replies; 15+ messages in thread
From: Edward Adam Davis @ 2026-09-03 13:05 UTC (permalink / raw)
To: eadavis
Cc: daniel, gregkh, linux-kernel, linux-sound, linux-usb, perex,
syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, tiwai, zonque
The epq_in_urb object belonging to the caiaq device is coupled within
the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
executes successfully, epq_in_urb is successfully added to the urbp_list
queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
layer driver for the caiaq USB device).
When init_card() calls snd_usb_caiaq_send_command() which subsequently
fails due to a timeout, and proceeds to call snd_card_free() to release
the card, the embedded ep1_in_urb object is also freed. When the dummy
HCD driver detects that the URB has been unlinked, it returns the URB
(by usb_hcd_giveback_urb()), which triggers [1].
Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
to using a pointer instead. Separately allocate and manage the memory for
ep1_in_urb to prevent the release of the snd_card memory object from
interfering with it.
midi_out_urb has the same issue as ep1_in_urb and is handled in the same
way.
[1]
BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
Call Trace:
usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
Allocated by task 36:
snd_card_new+0x7b/0x110 sound/core/init.c:184
create_card sound/usb/caiaq/device.c:429 [inline]
snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544
Freed by task 36:
snd_card_free_when_closed sound/core/init.c:630 [inline]
snd_card_free+0x138/0x1d0 sound/core/init.c:662
snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
v1 -> v2: same dealwith midi_out_urb and add missing check
v2 -> v3: set ep1_in_urb to NULL after midi_out_urb allow failed
remove err message when alloc failed
v3 -> v4: remove usb_init_urb() after use usb_alloc_urb
sound/usb/caiaq/device.c | 36 ++++++++++++++++++++++++------------
sound/usb/caiaq/device.h | 4 ++--
sound/usb/caiaq/midi.c | 6 +++---
3 files changed, 29 insertions(+), 17 deletions(-)
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index a16e59248480..3d821fde4582 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
break;
}
- cdev->ep1_in_urb.actual_length = 0;
- ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC);
+ cdev->ep1_in_urb->actual_length = 0;
+ ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
if (ret < 0)
dev_err(dev, "unable to submit urb. OOM!?\n");
}
@@ -408,6 +408,10 @@ static void card_free(struct snd_card *card)
#endif
snd_usb_caiaq_audio_free(cdev);
usb_put_dev(cdev->chip.dev);
+ usb_free_urb(cdev->ep1_in_urb);
+ cdev->ep1_in_urb = NULL;
+ usb_free_urb(cdev->midi_out_urb);
+ cdev->midi_out_urb = NULL;
}
static int create_card(struct usb_device *usb_dev,
@@ -457,22 +461,30 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
return -EIO;
}
- usb_init_urb(&cdev->ep1_in_urb);
- usb_init_urb(&cdev->midi_out_urb);
+ cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!cdev->ep1_in_urb)
+ return -ENOMEM;
- usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
+ cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!cdev->midi_out_urb) {
+ usb_free_urb(cdev->ep1_in_urb);
+ cdev->ep1_in_urb = NULL;
+ return -ENOMEM;
+ }
+
+ usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev,
usb_rcvbulkpipe(usb_dev, 0x1),
cdev->ep1_in_buf, EP1_BUFSIZE,
usb_ep1_command_reply_dispatch, cdev);
- usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
+ usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev,
usb_sndbulkpipe(usb_dev, 0x1),
cdev->midi_out_buf, EP1_BUFSIZE,
snd_usb_caiaq_midi_output_done, cdev);
/* sanity checks of EPs before actually submitting */
- if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
- usb_urb_ep_type_check(&cdev->midi_out_urb)) {
+ if (usb_urb_ep_type_check(cdev->ep1_in_urb) ||
+ usb_urb_ep_type_check(cdev->midi_out_urb)) {
dev_err(dev, "invalid EPs\n");
return -EINVAL;
}
@@ -480,7 +492,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
init_waitqueue_head(&cdev->ep1_wait_queue);
init_waitqueue_head(&cdev->prepare_wait_queue);
- if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
+ if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0)
return -EIO;
err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
@@ -530,7 +542,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
return 0;
err_kill_urb:
- usb_kill_urb(&cdev->ep1_in_urb);
+ usb_kill_urb(cdev->ep1_in_urb);
return err;
}
@@ -576,8 +588,8 @@ static void snd_disconnect(struct usb_interface *intf)
#endif
snd_usb_caiaq_audio_disconnect(cdev);
- usb_kill_urb(&cdev->ep1_in_urb);
- usb_kill_urb(&cdev->midi_out_urb);
+ usb_kill_urb(cdev->ep1_in_urb);
+ usb_kill_urb(cdev->midi_out_urb);
snd_card_free_when_closed(card);
}
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index 743eb0387b5f..1c6f34693fa8 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info;
struct snd_usb_caiaqdev {
struct snd_usb_audio chip;
- struct urb ep1_in_urb;
- struct urb midi_out_urb;
+ struct urb *ep1_in_urb;
+ struct urb *midi_out_urb;
struct urb **data_urbs_in;
struct urb **data_urbs_out;
struct snd_usb_caiaq_cb_info *data_cb_info;
diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
index c656d0162432..18529484c8dc 100644
--- a/sound/usb/caiaq/midi.c
+++ b/sound/usb/caiaq/midi.c
@@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre
{
struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data;
if (cdev->midi_out_active) {
- usb_kill_urb(&cdev->midi_out_urb);
+ usb_kill_urb(cdev->midi_out_urb);
cdev->midi_out_active = 0;
}
return 0;
@@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev,
return;
cdev->midi_out_buf[2] = len;
- cdev->midi_out_urb.transfer_buffer_length = len+3;
+ cdev->midi_out_urb->transfer_buffer_length = len+3;
- ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC);
+ ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC);
if (ret < 0)
dev_err(dev,
"snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread
* Re: DIY allocation or embedding of URBs in larger structures
2026-09-03 11:07 ` DIY allocation or embedding of URBs in larger structures Michal Pecio
@ 2026-09-03 14:37 ` Takashi Iwai
0 siblings, 0 replies; 15+ messages in thread
From: Takashi Iwai @ 2026-09-03 14:37 UTC (permalink / raw)
To: Michal Pecio
Cc: Takashi Iwai, syzbot, bolewara, devnull, gregkh, linux-kernel,
linux-media, linux-usb, mchehab, syzkaller-bugs, Daniel Mack,
Takashi Iwai, linux-sound
On Thu, 03 Sep 2026 13:07:57 +0200,
Michal Pecio wrote:
>
> On Thu, 03 Sep 2026 11:44:45 +0200, Takashi Iwai wrote:
> > On Thu, 03 Sep 2026 11:24:17 +0200,
> > Michal Pecio wrote:
> > > So what happens here is that USB core continues to use a URB after
> > > completion to implement things like usb_kill_urb(), so URBs are
> > > reference counted. Then core decrements the count - one more use.
> > >
> > > If a driver waits for completion or even usb_kill_urb() to return
> > > and then proceeds to free the URB's storage, this becomes a UAF.
> > > This driver embeds 2 URBs in its priv and does just that.
> > >
> > > A URB can only exist as an independent allocation, core will free
> > > it if upon finding zero reference count in such case.
> >
> > So, IIUC, now the URB *must* be always allocated via usb_alloc_urb()
> > and an embedded URB isn't allowed? If so, we'd need to address other
> > drivers, too.
>
> Yes, that's basically the case and actually has been for a long time.
>
> The only thing that works is for both USB and the driver to call
> usb_free_urb() and whoever does last will actually free the storage.
> This means URB can't share storage with anything else.
>
> Some drivers got away with making URB the first member of a struct
> which is freed together with it. AFAIK this pattern doesn't crash, but
> it's deprecated too because it puts a flexible member (in the URB) in
> the middle of (the outer) struct.
>
> This pattern here in caiaq has always been one race away from UAF.
> Maybe it wasn't very likely to happen, but stuff like PREEMPT_RT and
> hypervisors can insert unexpected delays anywhere these days.
>
> Greg KH puts it thusly:
> https://lore.kernel.org/linux-usb/2025120716-sway-hypnotic-8cb6@gregkh/
OK, I'll send the fix patches for the rest of sound drivers.
thanks,
Takashi
^ permalink raw reply [flat|nested] 15+ messages in thread
end of thread, other threads:[~2026-09-03 14:38 UTC | newest]
Thread overview: 15+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <6a6e9502.f794c993.27aeb.0018.GAE@google.com>
2026-09-02 5:09 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb syzbot
2026-09-03 8:47 ` [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev Edward Adam Davis
2026-09-03 9:32 ` Takashi Iwai
2026-09-03 9:41 ` Edward Adam Davis
2026-09-03 10:03 ` Takashi Iwai
2026-09-03 11:56 ` [PATCH v3] " Edward Adam Davis
2026-09-03 13:05 ` [PATCH v4] " Edward Adam Davis
2026-09-03 10:04 ` [PATCH v2] " Edward Adam Davis
2026-09-03 11:34 ` Michal Pecio
2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio
2026-09-03 9:44 ` Takashi Iwai
2026-09-03 11:07 ` DIY allocation or embedding of URBs in larger structures Michal Pecio
2026-09-03 14:37 ` Takashi Iwai
2026-09-03 9:55 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Hillf Danton
2026-09-03 10:01 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox