* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb [not found] <6a6e9502.f794c993.27aeb.0018.GAE@google.com> @ 2026-09-02 5:09 ` syzbot 2026-09-03 8:47 ` [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev Edward Adam Davis 2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio 0 siblings, 2 replies; 15+ messages in thread From: syzbot @ 2026-09-02 5:09 UTC (permalink / raw) To: bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs syzbot has found a reproducer for the following issue on: HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:.. git tree: upstream console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000 kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30 dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com usb 1-1: received EP1 urb->status = -2 ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline] BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline] BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline] BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline] BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200 instrument_atomic_read_write include/linux/instrumented.h:112 [inline] atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] __refcount_sub_and_test include/linux/refcount.h:389 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] kref_put include/linux/kref.h:64 [inline] usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 __run_hrtimer kernel/time/hrtimer.c:2067 [inline] __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] run_ktimerd+0x6a/0x100 kernel/softirq.c:1183 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 36: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5414 [inline] __kmalloc_noprof+0x41d/0x790 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] snd_card_new+0x7b/0x110 sound/core/init.c:184 create_card sound/usb/caiaq/device.c:429 [inline] snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x99a/0x1680 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 36: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x1c5/0x6d0 mm/slub.c:6792 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 snd_card_free_when_closed sound/core/init.c:630 [inline] snd_card_free+0x138/0x1d0 sound/core/init.c:662 snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x99a/0x1680 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff88803cee0000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 4176 bytes inside of freed 8192-byte region [ffff88803cee0000, ffff88803cee2000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3cee0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff88813ff00280 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 head: 0080000000000040 ffff88813ff00280 dead000000000122 0000000000000000 head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5616, tgid 5616 (syz-executor411), ts 97458631629 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2591/0x2600 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x230/0x5c0 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab+0x7d/0x620 mm/slub.c:3462 new_slab mm/slub.c:3513 [inline] refill_objects+0x2d8/0x350 mm/slub.c:7410 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x339/0x690 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __kmalloc_cache_noprof+0x46f/0x680 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] usb_device_dump+0xd0/0x2200 drivers/usb/core/devices.c:412 usb_device_read+0x1b4/0x2c0 drivers/usb/core/devices.c:530 full_proxy_read+0x127/0x1f0 fs/debugfs/file.c:379 vfs_read+0x219/0xa90 fs/read_write.c:572 ksys_read+0x156/0x270 fs/read_write.c:716 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5598 tgid 5598 ts 96447293579 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0xf8e/0x1070 mm/page_alloc.c:2962 __slab_free+0x250/0x2a0 mm/slub.c:5815 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] __kmalloc_cache_noprof+0x353/0x680 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] kernfs_fop_open+0x3a7/0xcf0 fs/kernfs/file.c:634 do_dentry_open+0x849/0x1420 fs/open.c:996 vfs_open+0x3b/0x350 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x1448/0x1d60 fs/namei.c:5000 do_file_open+0x23e/0x4a0 fs/namei.c:5029 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88803cee0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88803cee0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88803cee1000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88803cee1080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88803cee1100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. ^ permalink raw reply [flat|nested] 15+ messages in thread
* [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev 2026-09-02 5:09 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb syzbot @ 2026-09-03 8:47 ` Edward Adam Davis 2026-09-03 9:32 ` Takashi Iwai 2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio 1 sibling, 1 reply; 15+ messages in thread From: Edward Adam Davis @ 2026-09-03 8:47 UTC (permalink / raw) To: syzbot+832ce9fa3face1b7d44d Cc: zonque, perex, tiwai, daniel, linux-sound, gregkh, linux-kernel, linux-usb, syzkaller-bugs The epq_in_urb object belonging to the caiaq device is coupled within the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL) executes successfully, epq_in_urb is successfully added to the urbp_list queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD layer driver for the caiaq USB device). When init_card() calls snd_usb_caiaq_send_command() which subsequently fails due to a timeout, and proceeds to call snd_card_free() to release the card, the embedded ep1_in_urb object is also freed. When the dummy HCD driver detects that the URB has been unlinked, it returns the URB (by usb_hcd_giveback_urb()), which triggers [1]. Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch to using a pointer instead. Separately allocate and manage the memory for ep1_in_urb to prevent the release of the snd_card memory object from interfering with it. [1] BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 Call Trace: usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 __run_hrtimer kernel/time/hrtimer.c:2067 [inline] __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 Allocated by task 36: snd_card_new+0x7b/0x110 sound/core/init.c:184 create_card sound/usb/caiaq/device.c:429 [inline] snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544 Freed by task 36: snd_card_free_when_closed sound/core/init.c:630 [inline] snd_card_free+0x138/0x1d0 sound/core/init.c:662 snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553 Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@sina.com> --- sound/usb/caiaq/device.c | 19 +++++++++++-------- sound/usb/caiaq/device.h | 2 +- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c index a16e59248480..138b58914f1c 100644 --- a/sound/usb/caiaq/device.c +++ b/sound/usb/caiaq/device.c @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) break; } - cdev->ep1_in_urb.actual_length = 0; - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC); + cdev->ep1_in_urb->actual_length = 0; + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC); if (ret < 0) dev_err(dev, "unable to submit urb. OOM!?\n"); } @@ -408,6 +408,8 @@ static void card_free(struct snd_card *card) #endif snd_usb_caiaq_audio_free(cdev); usb_put_dev(cdev->chip.dev); + usb_free_urb(cdev->ep1_in_urb); + cdev->ep1_in_urb = NULL; } static int create_card(struct usb_device *usb_dev, @@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return -EIO; } - usb_init_urb(&cdev->ep1_in_urb); + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL); + usb_init_urb(cdev->ep1_in_urb); usb_init_urb(&cdev->midi_out_urb); - usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev, + usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev, usb_rcvbulkpipe(usb_dev, 0x1), cdev->ep1_in_buf, EP1_BUFSIZE, usb_ep1_command_reply_dispatch, cdev); @@ -471,7 +474,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) snd_usb_caiaq_midi_output_done, cdev); /* sanity checks of EPs before actually submitting */ - if (usb_urb_ep_type_check(&cdev->ep1_in_urb) || + if (usb_urb_ep_type_check(cdev->ep1_in_urb) || usb_urb_ep_type_check(&cdev->midi_out_urb)) { dev_err(dev, "invalid EPs\n"); return -EINVAL; @@ -480,7 +483,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) init_waitqueue_head(&cdev->ep1_wait_queue); init_waitqueue_head(&cdev->prepare_wait_queue); - if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0) + if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0) return -EIO; err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0); @@ -530,7 +533,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return 0; err_kill_urb: - usb_kill_urb(&cdev->ep1_in_urb); + usb_kill_urb(cdev->ep1_in_urb); return err; } @@ -576,7 +579,7 @@ static void snd_disconnect(struct usb_interface *intf) #endif snd_usb_caiaq_audio_disconnect(cdev); - usb_kill_urb(&cdev->ep1_in_urb); + usb_kill_urb(cdev->ep1_in_urb); usb_kill_urb(&cdev->midi_out_urb); snd_card_free_when_closed(card); diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h index 743eb0387b5f..a5f7dada25d8 100644 --- a/sound/usb/caiaq/device.h +++ b/sound/usb/caiaq/device.h @@ -60,7 +60,7 @@ struct snd_usb_caiaq_cb_info; struct snd_usb_caiaqdev { struct snd_usb_audio chip; - struct urb ep1_in_urb; + struct urb *ep1_in_urb; struct urb midi_out_urb; struct urb **data_urbs_in; struct urb **data_urbs_out; -- 2.43.0 ^ permalink raw reply related [flat|nested] 15+ messages in thread
* Re: [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev 2026-09-03 8:47 ` [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev Edward Adam Davis @ 2026-09-03 9:32 ` Takashi Iwai 2026-09-03 9:41 ` Edward Adam Davis 0 siblings, 1 reply; 15+ messages in thread From: Takashi Iwai @ 2026-09-03 9:32 UTC (permalink / raw) To: Edward Adam Davis Cc: syzbot+832ce9fa3face1b7d44d, zonque, perex, tiwai, daniel, linux-sound, gregkh, linux-kernel, linux-usb, syzkaller-bugs On Thu, 03 Sep 2026 10:47:47 +0200, Edward Adam Davis wrote: > > The epq_in_urb object belonging to the caiaq device is coupled within > the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL) > executes successfully, epq_in_urb is successfully added to the urbp_list > queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD > layer driver for the caiaq USB device). > > When init_card() calls snd_usb_caiaq_send_command() which subsequently > fails due to a timeout, and proceeds to call snd_card_free() to release > the card, the embedded ep1_in_urb object is also freed. When the dummy > HCD driver detects that the URB has been unlinked, it returns the URB > (by usb_hcd_giveback_urb()), which triggers [1]. > > Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch > to using a pointer instead. Separately allocate and manage the memory for > ep1_in_urb to prevent the release of the snd_card memory object from > interfering with it. > > [1] > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 > Call Trace: > usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 > __run_hrtimer kernel/time/hrtimer.c:2067 [inline] > __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 > hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 > > Allocated by task 36: > snd_card_new+0x7b/0x110 sound/core/init.c:184 > create_card sound/usb/caiaq/device.c:429 [inline] > snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544 > > Freed by task 36: > snd_card_free_when_closed sound/core/init.c:630 [inline] > snd_card_free+0x138/0x1d0 sound/core/init.c:662 > snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553 > > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") > Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d > Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis <eadavis@sina.com> > --- > sound/usb/caiaq/device.c | 19 +++++++++++-------- > sound/usb/caiaq/device.h | 2 +- > 2 files changed, 12 insertions(+), 9 deletions(-) > > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c > index a16e59248480..138b58914f1c 100644 > --- a/sound/usb/caiaq/device.c > +++ b/sound/usb/caiaq/device.c > @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) > break; > } > > - cdev->ep1_in_urb.actual_length = 0; > - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC); > + cdev->ep1_in_urb->actual_length = 0; > + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC); > if (ret < 0) > dev_err(dev, "unable to submit urb. OOM!?\n"); > } > @@ -408,6 +408,8 @@ static void card_free(struct snd_card *card) > #endif > snd_usb_caiaq_audio_free(cdev); > usb_put_dev(cdev->chip.dev); > + usb_free_urb(cdev->ep1_in_urb); > + cdev->ep1_in_urb = NULL; > } > > static int create_card(struct usb_device *usb_dev, > @@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev) > return -EIO; > } > > - usb_init_urb(&cdev->ep1_in_urb); > + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL); > + usb_init_urb(cdev->ep1_in_urb); The error check is missing here, as sashiko review pointed out. Could you fix and resubmit? (The other issues reported there -- the potential-double-free and the midi_out_urb handling can be skipped here; I'll fix those individually.) thanks, Takashi ^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev 2026-09-03 9:32 ` Takashi Iwai @ 2026-09-03 9:41 ` Edward Adam Davis 2026-09-03 10:03 ` Takashi Iwai 2026-09-03 10:04 ` [PATCH v2] " Edward Adam Davis 0 siblings, 2 replies; 15+ messages in thread From: Edward Adam Davis @ 2026-09-03 9:41 UTC (permalink / raw) To: tiwai Cc: daniel, eadavis, gregkh, linux-kernel, linux-sound, linux-usb, perex, syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, zonque From: Edward Aadm Davis <eadavis@sina.com> On Thu, 03 Sep 2026 11:32:22 +0200, Takashi Iwai wrote: > > The epq_in_urb object belonging to the caiaq device is coupled within > > the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL) > > executes successfully, epq_in_urb is successfully added to the urbp_list > > queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD > > layer driver for the caiaq USB device). > > > > When init_card() calls snd_usb_caiaq_send_command() which subsequently > > fails due to a timeout, and proceeds to call snd_card_free() to release > > the card, the embedded ep1_in_urb object is also freed. When the dummy > > HCD driver detects that the URB has been unlinked, it returns the URB > > (by usb_hcd_giveback_urb()), which triggers [1]. > > > > Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch > > to using a pointer instead. Separately allocate and manage the memory for > > ep1_in_urb to prevent the release of the snd_card memory object from > > interfering with it. > > > > [1] > > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 > > Call Trace: > > usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > > dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 > > __run_hrtimer kernel/time/hrtimer.c:2067 [inline] > > __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 > > hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 > > > > Allocated by task 36: > > snd_card_new+0x7b/0x110 sound/core/init.c:184 > > create_card sound/usb/caiaq/device.c:429 [inline] > > snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544 > > > > Freed by task 36: > > snd_card_free_when_closed sound/core/init.c:630 [inline] > > snd_card_free+0x138/0x1d0 sound/core/init.c:662 > > snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553 > > > > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > > Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") > > Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d > > Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > > Signed-off-by: Edward Adam Davis <eadavis@sina.com> > > --- > > sound/usb/caiaq/device.c | 19 +++++++++++-------- > > sound/usb/caiaq/device.h | 2 +- > > 2 files changed, 12 insertions(+), 9 deletions(-) > > > > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c > > index a16e59248480..138b58914f1c 100644 > > --- a/sound/usb/caiaq/device.c > > +++ b/sound/usb/caiaq/device.c > > @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) > > break; > > } > > > > - cdev->ep1_in_urb.actual_length = 0; > > - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC); > > + cdev->ep1_in_urb->actual_length = 0; > > + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC); > > if (ret < 0) > > dev_err(dev, "unable to submit urb. OOM!?\n"); > > } > > @@ -408,6 +408,8 @@ static void card_free(struct snd_card *card) > > #endif > > snd_usb_caiaq_audio_free(cdev); > > usb_put_dev(cdev->chip.dev); > > + usb_free_urb(cdev->ep1_in_urb); > > + cdev->ep1_in_urb = NULL; > > } > > > > static int create_card(struct usb_device *usb_dev, > > @@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev) > > return -EIO; > > } > > > > - usb_init_urb(&cdev->ep1_in_urb); > > + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL); > > + usb_init_urb(cdev->ep1_in_urb); > > The error check is missing here, as sashiko review pointed out. > Could you fix and resubmit? OK. I will fix and resubmit. > > (The other issues reported there -- the potential-double-free and the > midi_out_urb handling can be skipped here; I'll fix those > individually.) I can handle `midi_out_urb` as well. BR, Edward ^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev 2026-09-03 9:41 ` Edward Adam Davis @ 2026-09-03 10:03 ` Takashi Iwai 2026-09-03 11:56 ` [PATCH v3] " Edward Adam Davis 2026-09-03 10:04 ` [PATCH v2] " Edward Adam Davis 1 sibling, 1 reply; 15+ messages in thread From: Takashi Iwai @ 2026-09-03 10:03 UTC (permalink / raw) To: Edward Adam Davis Cc: tiwai, daniel, gregkh, linux-kernel, linux-sound, linux-usb, perex, syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, zonque On Thu, 03 Sep 2026 11:41:05 +0200, Edward Adam Davis wrote: > > From: Edward Aadm Davis <eadavis@sina.com> > > On Thu, 03 Sep 2026 11:32:22 +0200, Takashi Iwai wrote: > > > The epq_in_urb object belonging to the caiaq device is coupled within > > > the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL) > > > executes successfully, epq_in_urb is successfully added to the urbp_list > > > queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD > > > layer driver for the caiaq USB device). > > > > > > When init_card() calls snd_usb_caiaq_send_command() which subsequently > > > fails due to a timeout, and proceeds to call snd_card_free() to release > > > the card, the embedded ep1_in_urb object is also freed. When the dummy > > > HCD driver detects that the URB has been unlinked, it returns the URB > > > (by usb_hcd_giveback_urb()), which triggers [1]. > > > > > > Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch > > > to using a pointer instead. Separately allocate and manage the memory for > > > ep1_in_urb to prevent the release of the snd_card memory object from > > > interfering with it. > > > > > > [1] > > > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > > > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 > > > Call Trace: > > > usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > > > dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 > > > __run_hrtimer kernel/time/hrtimer.c:2067 [inline] > > > __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 > > > hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 > > > > > > Allocated by task 36: > > > snd_card_new+0x7b/0x110 sound/core/init.c:184 > > > create_card sound/usb/caiaq/device.c:429 [inline] > > > snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544 > > > > > > Freed by task 36: > > > snd_card_free_when_closed sound/core/init.c:630 [inline] > > > snd_card_free+0x138/0x1d0 sound/core/init.c:662 > > > snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553 > > > > > > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > > > Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") > > > Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d > > > Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > > > Signed-off-by: Edward Adam Davis <eadavis@sina.com> > > > --- > > > sound/usb/caiaq/device.c | 19 +++++++++++-------- > > > sound/usb/caiaq/device.h | 2 +- > > > 2 files changed, 12 insertions(+), 9 deletions(-) > > > > > > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c > > > index a16e59248480..138b58914f1c 100644 > > > --- a/sound/usb/caiaq/device.c > > > +++ b/sound/usb/caiaq/device.c > > > @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) > > > break; > > > } > > > > > > - cdev->ep1_in_urb.actual_length = 0; > > > - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC); > > > + cdev->ep1_in_urb->actual_length = 0; > > > + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC); > > > if (ret < 0) > > > dev_err(dev, "unable to submit urb. OOM!?\n"); > > > } > > > @@ -408,6 +408,8 @@ static void card_free(struct snd_card *card) > > > #endif > > > snd_usb_caiaq_audio_free(cdev); > > > usb_put_dev(cdev->chip.dev); > > > + usb_free_urb(cdev->ep1_in_urb); > > > + cdev->ep1_in_urb = NULL; > > > } > > > > > > static int create_card(struct usb_device *usb_dev, > > > @@ -457,10 +459,11 @@ static int init_card(struct snd_usb_caiaqdev *cdev) > > > return -EIO; > > > } > > > > > > - usb_init_urb(&cdev->ep1_in_urb); > > > + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL); > > > + usb_init_urb(cdev->ep1_in_urb); > > > > The error check is missing here, as sashiko review pointed out. > > Could you fix and resubmit? > OK. I will fix and resubmit. > > > > (The other issues reported there -- the potential-double-free and the > > midi_out_urb handling can be skipped here; I'll fix those > > individually.) > I can handle `midi_out_urb` as well. OK, then let's shoot both URBs in a shot. thanks, Takashi ^ permalink raw reply [flat|nested] 15+ messages in thread
* [PATCH v3] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev 2026-09-03 10:03 ` Takashi Iwai @ 2026-09-03 11:56 ` Edward Adam Davis 2026-09-03 13:05 ` [PATCH v4] " Edward Adam Davis 0 siblings, 1 reply; 15+ messages in thread From: Edward Adam Davis @ 2026-09-03 11:56 UTC (permalink / raw) To: tiwai Cc: daniel, eadavis, gregkh, linux-kernel, linux-sound, linux-usb, perex, syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, zonque The epq_in_urb object belonging to the caiaq device is coupled within the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL) executes successfully, epq_in_urb is successfully added to the urbp_list queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD layer driver for the caiaq USB device). When init_card() calls snd_usb_caiaq_send_command() which subsequently fails due to a timeout, and proceeds to call snd_card_free() to release the card, the embedded ep1_in_urb object is also freed. When the dummy HCD driver detects that the URB has been unlinked, it returns the URB (by usb_hcd_giveback_urb()), which triggers [1]. Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch to using a pointer instead. Separately allocate and manage the memory for ep1_in_urb to prevent the release of the snd_card memory object from interfering with it. midi_out_urb has the same issue as ep1_in_urb and is handled in the same way. [1] BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 Call Trace: usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 __run_hrtimer kernel/time/hrtimer.c:2067 [inline] __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 Allocated by task 36: snd_card_new+0x7b/0x110 sound/core/init.c:184 create_card sound/usb/caiaq/device.c:429 [inline] snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544 Freed by task 36: snd_card_free_when_closed sound/core/init.c:630 [inline] snd_card_free+0x138/0x1d0 sound/core/init.c:662 snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553 Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@sina.com> --- v1 -> v2: same dealwith midi_out_urb and add missing check v2 -> v3: set ep1_in_urb to NULL after midi_out_urb allow failed remove err message when alloc failed sound/usb/caiaq/device.c | 38 ++++++++++++++++++++++++++------------ sound/usb/caiaq/device.h | 4 ++-- sound/usb/caiaq/midi.c | 6 +++--- 3 files changed, 31 insertions(+), 17 deletions(-) diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c index a16e59248480..ff761978a1cf 100644 --- a/sound/usb/caiaq/device.c +++ b/sound/usb/caiaq/device.c @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) break; } - cdev->ep1_in_urb.actual_length = 0; - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC); + cdev->ep1_in_urb->actual_length = 0; + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC); if (ret < 0) dev_err(dev, "unable to submit urb. OOM!?\n"); } @@ -408,6 +408,10 @@ static void card_free(struct snd_card *card) #endif snd_usb_caiaq_audio_free(cdev); usb_put_dev(cdev->chip.dev); + usb_free_urb(cdev->ep1_in_urb); + cdev->ep1_in_urb = NULL; + usb_free_urb(cdev->midi_out_urb); + cdev->midi_out_urb = NULL; } static int create_card(struct usb_device *usb_dev, @@ -457,22 +461,32 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return -EIO; } - usb_init_urb(&cdev->ep1_in_urb); - usb_init_urb(&cdev->midi_out_urb); + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!cdev->ep1_in_urb) + return -ENOMEM; - usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev, + cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!cdev->midi_out_urb) { + usb_free_urb(cdev->ep1_in_urb); + cdev->ep1_in_urb = NULL; + return -ENOMEM; + } + usb_init_urb(cdev->ep1_in_urb); + usb_init_urb(cdev->midi_out_urb); + + usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev, usb_rcvbulkpipe(usb_dev, 0x1), cdev->ep1_in_buf, EP1_BUFSIZE, usb_ep1_command_reply_dispatch, cdev); - usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev, + usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev, usb_sndbulkpipe(usb_dev, 0x1), cdev->midi_out_buf, EP1_BUFSIZE, snd_usb_caiaq_midi_output_done, cdev); /* sanity checks of EPs before actually submitting */ - if (usb_urb_ep_type_check(&cdev->ep1_in_urb) || - usb_urb_ep_type_check(&cdev->midi_out_urb)) { + if (usb_urb_ep_type_check(cdev->ep1_in_urb) || + usb_urb_ep_type_check(cdev->midi_out_urb)) { dev_err(dev, "invalid EPs\n"); return -EINVAL; } @@ -480,7 +494,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) init_waitqueue_head(&cdev->ep1_wait_queue); init_waitqueue_head(&cdev->prepare_wait_queue); - if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0) + if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0) return -EIO; err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0); @@ -530,7 +544,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return 0; err_kill_urb: - usb_kill_urb(&cdev->ep1_in_urb); + usb_kill_urb(cdev->ep1_in_urb); return err; } @@ -576,8 +590,8 @@ static void snd_disconnect(struct usb_interface *intf) #endif snd_usb_caiaq_audio_disconnect(cdev); - usb_kill_urb(&cdev->ep1_in_urb); - usb_kill_urb(&cdev->midi_out_urb); + usb_kill_urb(cdev->ep1_in_urb); + usb_kill_urb(cdev->midi_out_urb); snd_card_free_when_closed(card); } diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h index 743eb0387b5f..1c6f34693fa8 100644 --- a/sound/usb/caiaq/device.h +++ b/sound/usb/caiaq/device.h @@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info; struct snd_usb_caiaqdev { struct snd_usb_audio chip; - struct urb ep1_in_urb; - struct urb midi_out_urb; + struct urb *ep1_in_urb; + struct urb *midi_out_urb; struct urb **data_urbs_in; struct urb **data_urbs_out; struct snd_usb_caiaq_cb_info *data_cb_info; diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c index c656d0162432..18529484c8dc 100644 --- a/sound/usb/caiaq/midi.c +++ b/sound/usb/caiaq/midi.c @@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre { struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data; if (cdev->midi_out_active) { - usb_kill_urb(&cdev->midi_out_urb); + usb_kill_urb(cdev->midi_out_urb); cdev->midi_out_active = 0; } return 0; @@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev, return; cdev->midi_out_buf[2] = len; - cdev->midi_out_urb.transfer_buffer_length = len+3; + cdev->midi_out_urb->transfer_buffer_length = len+3; - ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC); + ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC); if (ret < 0) dev_err(dev, "snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed," -- 2.43.0 ^ permalink raw reply related [flat|nested] 15+ messages in thread
* [PATCH v4] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev 2026-09-03 11:56 ` [PATCH v3] " Edward Adam Davis @ 2026-09-03 13:05 ` Edward Adam Davis 0 siblings, 0 replies; 15+ messages in thread From: Edward Adam Davis @ 2026-09-03 13:05 UTC (permalink / raw) To: eadavis Cc: daniel, gregkh, linux-kernel, linux-sound, linux-usb, perex, syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, tiwai, zonque The epq_in_urb object belonging to the caiaq device is coupled within the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL) executes successfully, epq_in_urb is successfully added to the urbp_list queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD layer driver for the caiaq USB device). When init_card() calls snd_usb_caiaq_send_command() which subsequently fails due to a timeout, and proceeds to call snd_card_free() to release the card, the embedded ep1_in_urb object is also freed. When the dummy HCD driver detects that the URB has been unlinked, it returns the URB (by usb_hcd_giveback_urb()), which triggers [1]. Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch to using a pointer instead. Separately allocate and manage the memory for ep1_in_urb to prevent the release of the snd_card memory object from interfering with it. midi_out_urb has the same issue as ep1_in_urb and is handled in the same way. [1] BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 Call Trace: usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 __run_hrtimer kernel/time/hrtimer.c:2067 [inline] __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 Allocated by task 36: snd_card_new+0x7b/0x110 sound/core/init.c:184 create_card sound/usb/caiaq/device.c:429 [inline] snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544 Freed by task 36: snd_card_free_when_closed sound/core/init.c:630 [inline] snd_card_free+0x138/0x1d0 sound/core/init.c:662 snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553 Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@sina.com> --- v1 -> v2: same dealwith midi_out_urb and add missing check v2 -> v3: set ep1_in_urb to NULL after midi_out_urb allow failed remove err message when alloc failed v3 -> v4: remove usb_init_urb() after use usb_alloc_urb sound/usb/caiaq/device.c | 36 ++++++++++++++++++++++++------------ sound/usb/caiaq/device.h | 4 ++-- sound/usb/caiaq/midi.c | 6 +++--- 3 files changed, 29 insertions(+), 17 deletions(-) diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c index a16e59248480..3d821fde4582 100644 --- a/sound/usb/caiaq/device.c +++ b/sound/usb/caiaq/device.c @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) break; } - cdev->ep1_in_urb.actual_length = 0; - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC); + cdev->ep1_in_urb->actual_length = 0; + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC); if (ret < 0) dev_err(dev, "unable to submit urb. OOM!?\n"); } @@ -408,6 +408,10 @@ static void card_free(struct snd_card *card) #endif snd_usb_caiaq_audio_free(cdev); usb_put_dev(cdev->chip.dev); + usb_free_urb(cdev->ep1_in_urb); + cdev->ep1_in_urb = NULL; + usb_free_urb(cdev->midi_out_urb); + cdev->midi_out_urb = NULL; } static int create_card(struct usb_device *usb_dev, @@ -457,22 +461,30 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return -EIO; } - usb_init_urb(&cdev->ep1_in_urb); - usb_init_urb(&cdev->midi_out_urb); + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!cdev->ep1_in_urb) + return -ENOMEM; - usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev, + cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!cdev->midi_out_urb) { + usb_free_urb(cdev->ep1_in_urb); + cdev->ep1_in_urb = NULL; + return -ENOMEM; + } + + usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev, usb_rcvbulkpipe(usb_dev, 0x1), cdev->ep1_in_buf, EP1_BUFSIZE, usb_ep1_command_reply_dispatch, cdev); - usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev, + usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev, usb_sndbulkpipe(usb_dev, 0x1), cdev->midi_out_buf, EP1_BUFSIZE, snd_usb_caiaq_midi_output_done, cdev); /* sanity checks of EPs before actually submitting */ - if (usb_urb_ep_type_check(&cdev->ep1_in_urb) || - usb_urb_ep_type_check(&cdev->midi_out_urb)) { + if (usb_urb_ep_type_check(cdev->ep1_in_urb) || + usb_urb_ep_type_check(cdev->midi_out_urb)) { dev_err(dev, "invalid EPs\n"); return -EINVAL; } @@ -480,7 +492,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) init_waitqueue_head(&cdev->ep1_wait_queue); init_waitqueue_head(&cdev->prepare_wait_queue); - if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0) + if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0) return -EIO; err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0); @@ -530,7 +542,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return 0; err_kill_urb: - usb_kill_urb(&cdev->ep1_in_urb); + usb_kill_urb(cdev->ep1_in_urb); return err; } @@ -576,8 +588,8 @@ static void snd_disconnect(struct usb_interface *intf) #endif snd_usb_caiaq_audio_disconnect(cdev); - usb_kill_urb(&cdev->ep1_in_urb); - usb_kill_urb(&cdev->midi_out_urb); + usb_kill_urb(cdev->ep1_in_urb); + usb_kill_urb(cdev->midi_out_urb); snd_card_free_when_closed(card); } diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h index 743eb0387b5f..1c6f34693fa8 100644 --- a/sound/usb/caiaq/device.h +++ b/sound/usb/caiaq/device.h @@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info; struct snd_usb_caiaqdev { struct snd_usb_audio chip; - struct urb ep1_in_urb; - struct urb midi_out_urb; + struct urb *ep1_in_urb; + struct urb *midi_out_urb; struct urb **data_urbs_in; struct urb **data_urbs_out; struct snd_usb_caiaq_cb_info *data_cb_info; diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c index c656d0162432..18529484c8dc 100644 --- a/sound/usb/caiaq/midi.c +++ b/sound/usb/caiaq/midi.c @@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre { struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data; if (cdev->midi_out_active) { - usb_kill_urb(&cdev->midi_out_urb); + usb_kill_urb(cdev->midi_out_urb); cdev->midi_out_active = 0; } return 0; @@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev, return; cdev->midi_out_buf[2] = len; - cdev->midi_out_urb.transfer_buffer_length = len+3; + cdev->midi_out_urb->transfer_buffer_length = len+3; - ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC); + ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC); if (ret < 0) dev_err(dev, "snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed," -- 2.43.0 ^ permalink raw reply related [flat|nested] 15+ messages in thread
* [PATCH v2] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev 2026-09-03 9:41 ` Edward Adam Davis 2026-09-03 10:03 ` Takashi Iwai @ 2026-09-03 10:04 ` Edward Adam Davis 2026-09-03 11:34 ` Michal Pecio 1 sibling, 1 reply; 15+ messages in thread From: Edward Adam Davis @ 2026-09-03 10:04 UTC (permalink / raw) To: eadavis Cc: daniel, gregkh, linux-kernel, linux-sound, linux-usb, perex, syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, tiwai, zonque The epq_in_urb object belonging to the caiaq device is coupled within the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL) executes successfully, epq_in_urb is successfully added to the urbp_list queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD layer driver for the caiaq USB device). When init_card() calls snd_usb_caiaq_send_command() which subsequently fails due to a timeout, and proceeds to call snd_card_free() to release the card, the embedded ep1_in_urb object is also freed. When the dummy HCD driver detects that the URB has been unlinked, it returns the URB (by usb_hcd_giveback_urb()), which triggers [1]. Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch to using a pointer instead. Separately allocate and manage the memory for ep1_in_urb to prevent the release of the snd_card memory object from interfering with it. midi_out_urb has the same issue as ep1_in_urb and is handled in the same way. [1] BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 Call Trace: usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 __run_hrtimer kernel/time/hrtimer.c:2067 [inline] __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 Allocated by task 36: snd_card_new+0x7b/0x110 sound/core/init.c:184 create_card sound/usb/caiaq/device.c:429 [inline] snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544 Freed by task 36: snd_card_free_when_closed sound/core/init.c:630 [inline] snd_card_free+0x138/0x1d0 sound/core/init.c:662 snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553 Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@sina.com> --- v1 -> v2: same dealwith midi_out_urb and add missing check sound/usb/caiaq/device.c | 39 +++++++++++++++++++++++++++------------ sound/usb/caiaq/device.h | 4 ++-- sound/usb/caiaq/midi.c | 6 +++--- 3 files changed, 32 insertions(+), 17 deletions(-) diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c index a16e59248480..d0fe954b8133 100644 --- a/sound/usb/caiaq/device.c +++ b/sound/usb/caiaq/device.c @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) break; } - cdev->ep1_in_urb.actual_length = 0; - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC); + cdev->ep1_in_urb->actual_length = 0; + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC); if (ret < 0) dev_err(dev, "unable to submit urb. OOM!?\n"); } @@ -408,6 +408,10 @@ static void card_free(struct snd_card *card) #endif snd_usb_caiaq_audio_free(cdev); usb_put_dev(cdev->chip.dev); + usb_free_urb(cdev->ep1_in_urb); + cdev->ep1_in_urb = NULL; + usb_free_urb(cdev->midi_out_urb); + cdev->midi_out_urb = NULL; } static int create_card(struct usb_device *usb_dev, @@ -457,22 +461,33 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return -EIO; } - usb_init_urb(&cdev->ep1_in_urb); - usb_init_urb(&cdev->midi_out_urb); + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!cdev->ep1_in_urb) { + dev_err(dev, "alloc ep1_in_urb failed.\n"); + return -ENOMEM; + } + cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!cdev->midi_out_urb) { + usb_free_urb(cdev->ep1_in_urb); + dev_err(dev, "alloc midi_out_urb failed.\n"); + return -ENOMEM; + } + usb_init_urb(cdev->ep1_in_urb); + usb_init_urb(cdev->midi_out_urb); - usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev, + usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev, usb_rcvbulkpipe(usb_dev, 0x1), cdev->ep1_in_buf, EP1_BUFSIZE, usb_ep1_command_reply_dispatch, cdev); - usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev, + usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev, usb_sndbulkpipe(usb_dev, 0x1), cdev->midi_out_buf, EP1_BUFSIZE, snd_usb_caiaq_midi_output_done, cdev); /* sanity checks of EPs before actually submitting */ - if (usb_urb_ep_type_check(&cdev->ep1_in_urb) || - usb_urb_ep_type_check(&cdev->midi_out_urb)) { + if (usb_urb_ep_type_check(cdev->ep1_in_urb) || + usb_urb_ep_type_check(cdev->midi_out_urb)) { dev_err(dev, "invalid EPs\n"); return -EINVAL; } @@ -480,7 +495,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) init_waitqueue_head(&cdev->ep1_wait_queue); init_waitqueue_head(&cdev->prepare_wait_queue); - if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0) + if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0) return -EIO; err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0); @@ -530,7 +545,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return 0; err_kill_urb: - usb_kill_urb(&cdev->ep1_in_urb); + usb_kill_urb(cdev->ep1_in_urb); return err; } @@ -576,8 +591,8 @@ static void snd_disconnect(struct usb_interface *intf) #endif snd_usb_caiaq_audio_disconnect(cdev); - usb_kill_urb(&cdev->ep1_in_urb); - usb_kill_urb(&cdev->midi_out_urb); + usb_kill_urb(cdev->ep1_in_urb); + usb_kill_urb(cdev->midi_out_urb); snd_card_free_when_closed(card); } diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h index 743eb0387b5f..1c6f34693fa8 100644 --- a/sound/usb/caiaq/device.h +++ b/sound/usb/caiaq/device.h @@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info; struct snd_usb_caiaqdev { struct snd_usb_audio chip; - struct urb ep1_in_urb; - struct urb midi_out_urb; + struct urb *ep1_in_urb; + struct urb *midi_out_urb; struct urb **data_urbs_in; struct urb **data_urbs_out; struct snd_usb_caiaq_cb_info *data_cb_info; diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c index c656d0162432..18529484c8dc 100644 --- a/sound/usb/caiaq/midi.c +++ b/sound/usb/caiaq/midi.c @@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre { struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data; if (cdev->midi_out_active) { - usb_kill_urb(&cdev->midi_out_urb); + usb_kill_urb(cdev->midi_out_urb); cdev->midi_out_active = 0; } return 0; @@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev, return; cdev->midi_out_buf[2] = len; - cdev->midi_out_urb.transfer_buffer_length = len+3; + cdev->midi_out_urb->transfer_buffer_length = len+3; - ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC); + ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC); if (ret < 0) dev_err(dev, "snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed," -- 2.43.0 ^ permalink raw reply related [flat|nested] 15+ messages in thread
* Re: [PATCH v2] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev 2026-09-03 10:04 ` [PATCH v2] " Edward Adam Davis @ 2026-09-03 11:34 ` Michal Pecio 0 siblings, 0 replies; 15+ messages in thread From: Michal Pecio @ 2026-09-03 11:34 UTC (permalink / raw) To: Edward Adam Davis Cc: daniel, gregkh, linux-kernel, linux-sound, linux-usb, perex, syzbot+832ce9fa3face1b7d44d, syzkaller-bugs, tiwai, tiwai, zonque On Thu, 3 Sep 2026 18:04:10 +0800, Edward Adam Davis wrote: > The epq_in_urb object belonging to the caiaq device is coupled within > the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL) > executes successfully, epq_in_urb is successfully added to the urbp_list > queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD > layer driver for the caiaq USB device). Sounds like an irrelevant detail. Same crash would happen with any HCD. > When init_card() calls snd_usb_caiaq_send_command() which subsequently > fails due to a timeout, and proceeds to call snd_card_free() to release > the card, the embedded ep1_in_urb object is also freed. When the dummy > HCD driver detects that the URB has been unlinked, it returns the URB > (by usb_hcd_giveback_urb()), which triggers [1]. > > Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch > to using a pointer instead. Separately allocate and manage the memory for > ep1_in_urb to prevent the release of the snd_card memory object from > interfering with it. > > midi_out_urb has the same issue as ep1_in_urb and is handled in the same > way. > > [1] > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 > Call Trace: > usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 > __run_hrtimer kernel/time/hrtimer.c:2067 [inline] > __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 > hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 > > Allocated by task 36: > snd_card_new+0x7b/0x110 sound/core/init.c:184 > create_card sound/usb/caiaq/device.c:429 [inline] > snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544 > > Freed by task 36: > snd_card_free_when_closed sound/core/init.c:630 [inline] > snd_card_free+0x138/0x1d0 sound/core/init.c:662 > snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553 > > Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d > Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis <eadavis@sina.com> > --- Does this submission comply with the rules here? https://docs.kernel.org/process/coding-assistants.html > v1 -> v2: same dealwith midi_out_urb and add missing check > > sound/usb/caiaq/device.c | 39 +++++++++++++++++++++++++++------------ > sound/usb/caiaq/device.h | 4 ++-- > sound/usb/caiaq/midi.c | 6 +++--- > 3 files changed, 32 insertions(+), 17 deletions(-) > > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c > index a16e59248480..d0fe954b8133 100644 > --- a/sound/usb/caiaq/device.c > +++ b/sound/usb/caiaq/device.c > @@ -192,8 +192,8 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) > break; > } > > - cdev->ep1_in_urb.actual_length = 0; > - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC); > + cdev->ep1_in_urb->actual_length = 0; That's one of the first things usb_submit_urb() below would do, and has done since forever. > + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC); > if (ret < 0) > dev_err(dev, "unable to submit urb. OOM!?\n"); > } > @@ -408,6 +408,10 @@ static void card_free(struct snd_card *card) > #endif > snd_usb_caiaq_audio_free(cdev); > usb_put_dev(cdev->chip.dev); > + usb_free_urb(cdev->ep1_in_urb); > + cdev->ep1_in_urb = NULL; > + usb_free_urb(cdev->midi_out_urb); > + cdev->midi_out_urb = NULL; Is clearing this necessary? (I'm not familiar with ALSA) > } > > static int create_card(struct usb_device *usb_dev, > @@ -457,22 +461,33 @@ static int init_card(struct snd_usb_caiaqdev *cdev) > return -EIO; > } > > - usb_init_urb(&cdev->ep1_in_urb); > - usb_init_urb(&cdev->midi_out_urb); > + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL); > + if (!cdev->ep1_in_urb) { > + dev_err(dev, "alloc ep1_in_urb failed.\n"); AFAIK logging on allocation failure is frowned upon. > + return -ENOMEM; > + } > + cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL); > + if (!cdev->midi_out_urb) { > + usb_free_urb(cdev->ep1_in_urb); > + dev_err(dev, "alloc midi_out_urb failed.\n"); > + return -ENOMEM; > + } > + usb_init_urb(cdev->ep1_in_urb); > + usb_init_urb(cdev->midi_out_urb); And what would be the point of that? > > - usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev, > + usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev, > usb_rcvbulkpipe(usb_dev, 0x1), > cdev->ep1_in_buf, EP1_BUFSIZE, > usb_ep1_command_reply_dispatch, cdev); > > - usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev, > + usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev, > usb_sndbulkpipe(usb_dev, 0x1), > cdev->midi_out_buf, EP1_BUFSIZE, > snd_usb_caiaq_midi_output_done, cdev); > > /* sanity checks of EPs before actually submitting */ > - if (usb_urb_ep_type_check(&cdev->ep1_in_urb) || > - usb_urb_ep_type_check(&cdev->midi_out_urb)) { > + if (usb_urb_ep_type_check(cdev->ep1_in_urb) || > + usb_urb_ep_type_check(cdev->midi_out_urb)) { > dev_err(dev, "invalid EPs\n"); > return -EINVAL; > } > @@ -480,7 +495,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) > init_waitqueue_head(&cdev->ep1_wait_queue); > init_waitqueue_head(&cdev->prepare_wait_queue); > > - if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0) > + if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0) > return -EIO; > > err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0); > @@ -530,7 +545,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) > return 0; > > err_kill_urb: > - usb_kill_urb(&cdev->ep1_in_urb); > + usb_kill_urb(cdev->ep1_in_urb); > return err; > } > > @@ -576,8 +591,8 @@ static void snd_disconnect(struct usb_interface *intf) > #endif > snd_usb_caiaq_audio_disconnect(cdev); > > - usb_kill_urb(&cdev->ep1_in_urb); > - usb_kill_urb(&cdev->midi_out_urb); > + usb_kill_urb(cdev->ep1_in_urb); > + usb_kill_urb(cdev->midi_out_urb); > > snd_card_free_when_closed(card); > } > diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h > index 743eb0387b5f..1c6f34693fa8 100644 > --- a/sound/usb/caiaq/device.h > +++ b/sound/usb/caiaq/device.h > @@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info; > struct snd_usb_caiaqdev { > struct snd_usb_audio chip; > > - struct urb ep1_in_urb; > - struct urb midi_out_urb; > + struct urb *ep1_in_urb; > + struct urb *midi_out_urb; > struct urb **data_urbs_in; > struct urb **data_urbs_out; > struct snd_usb_caiaq_cb_info *data_cb_info; > diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c > index c656d0162432..18529484c8dc 100644 > --- a/sound/usb/caiaq/midi.c > +++ b/sound/usb/caiaq/midi.c > @@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre > { > struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data; > if (cdev->midi_out_active) { > - usb_kill_urb(&cdev->midi_out_urb); > + usb_kill_urb(cdev->midi_out_urb); > cdev->midi_out_active = 0; > } > return 0; > @@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev, > return; > > cdev->midi_out_buf[2] = len; > - cdev->midi_out_urb.transfer_buffer_length = len+3; > + cdev->midi_out_urb->transfer_buffer_length = len+3; > > - ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC); > + ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC); > if (ret < 0) > dev_err(dev, > "snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed," > -- > 2.43.0 > ^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb 2026-09-02 5:09 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb syzbot 2026-09-03 8:47 ` [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev Edward Adam Davis @ 2026-09-03 9:24 ` Michal Pecio 2026-09-03 9:44 ` Takashi Iwai ` (2 more replies) 1 sibling, 3 replies; 15+ messages in thread From: Michal Pecio @ 2026-09-03 9:24 UTC (permalink / raw) To: syzbot Cc: bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai, linux-sound On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote: > syzbot has found a reproducer for the following issue on: > > HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:.. > git tree: upstream > console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30 > dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d > compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz > kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > > usb 1-1: received EP1 urb->status = -2 > ================================================================== > BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] > BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] > BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline] > BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline] > BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline] > BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline] > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 > > CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 > Call Trace: > <TASK> > dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 > print_address_description+0x55/0x1e0 mm/kasan/report.c:378 > print_report+0x58/0x70 mm/kasan/report.c:482 > kasan_report+0x117/0x150 mm/kasan/report.c:595 > check_region_inline mm/kasan/generic.c:-1 [inline] > kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200 > instrument_atomic_read_write include/linux/instrumented.h:112 [inline] > atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] > __refcount_sub_and_test include/linux/refcount.h:389 [inline] > __refcount_dec_and_test include/linux/refcount.h:432 [inline] > refcount_dec_and_test include/linux/refcount.h:450 [inline] > kref_put include/linux/kref.h:64 [inline] > usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 > __run_hrtimer kernel/time/hrtimer.c:2067 [inline] > __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 > hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 > handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 > __do_softirq kernel/softirq.c:679 [inline] > run_ktimerd+0x6a/0x100 kernel/softirq.c:1183 > smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 > kthread+0x38b/0x470 kernel/kthread.c:436 > ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 > </TASK> [Adding sound people] So what happens here is that USB core continues to use a URB after completion to implement things like usb_kill_urb(), so URBs are reference counted. Then core decrements the count - one more use. If a driver waits for completion or even usb_kill_urb() to return and then proceeds to free the URB's storage, this becomes a UAF. This driver embeds 2 URBs in its priv and does just that. A URB can only exist as an independent allocation, core will free it if upon finding zero reference count in such case. This is a mechanical conversion, untested. I don't have the HW. #syz test diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c index a16e59248480..3587794207d4 100644 --- a/sound/usb/caiaq/device.c +++ b/sound/usb/caiaq/device.c @@ -192,8 +192,7 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) break; } - cdev->ep1_in_urb.actual_length = 0; - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC); + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC); if (ret < 0) dev_err(dev, "unable to submit urb. OOM!?\n"); } @@ -403,6 +402,8 @@ static void card_free(struct snd_card *card) { struct snd_usb_caiaqdev *cdev = caiaqdev(card); + usb_free_urb(cdev->ep1_in_urb); + usb_free_urb(cdev->midi_out_urb); #ifdef CONFIG_SND_USB_CAIAQ_INPUT snd_usb_caiaq_input_free(cdev); #endif @@ -457,22 +458,24 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return -EIO; } - usb_init_urb(&cdev->ep1_in_urb); - usb_init_urb(&cdev->midi_out_urb); + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL); + cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!cdev->ep1_in_urb || !cdev->midi_out_urb) + return -ENOMEM; - usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev, + usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev, usb_rcvbulkpipe(usb_dev, 0x1), cdev->ep1_in_buf, EP1_BUFSIZE, usb_ep1_command_reply_dispatch, cdev); - usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev, + usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev, usb_sndbulkpipe(usb_dev, 0x1), cdev->midi_out_buf, EP1_BUFSIZE, snd_usb_caiaq_midi_output_done, cdev); /* sanity checks of EPs before actually submitting */ - if (usb_urb_ep_type_check(&cdev->ep1_in_urb) || - usb_urb_ep_type_check(&cdev->midi_out_urb)) { + if (usb_urb_ep_type_check(cdev->ep1_in_urb) || + usb_urb_ep_type_check(cdev->midi_out_urb)) { dev_err(dev, "invalid EPs\n"); return -EINVAL; } @@ -480,7 +483,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) init_waitqueue_head(&cdev->ep1_wait_queue); init_waitqueue_head(&cdev->prepare_wait_queue); - if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0) + if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0) return -EIO; err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0); @@ -530,7 +533,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return 0; err_kill_urb: - usb_kill_urb(&cdev->ep1_in_urb); + usb_kill_urb(cdev->ep1_in_urb); return err; } @@ -576,8 +579,8 @@ static void snd_disconnect(struct usb_interface *intf) #endif snd_usb_caiaq_audio_disconnect(cdev); - usb_kill_urb(&cdev->ep1_in_urb); - usb_kill_urb(&cdev->midi_out_urb); + usb_kill_urb(cdev->ep1_in_urb); + usb_kill_urb(cdev->midi_out_urb); snd_card_free_when_closed(card); } diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h index 743eb0387b5f..1c6f34693fa8 100644 --- a/sound/usb/caiaq/device.h +++ b/sound/usb/caiaq/device.h @@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info; struct snd_usb_caiaqdev { struct snd_usb_audio chip; - struct urb ep1_in_urb; - struct urb midi_out_urb; + struct urb *ep1_in_urb; + struct urb *midi_out_urb; struct urb **data_urbs_in; struct urb **data_urbs_out; struct snd_usb_caiaq_cb_info *data_cb_info; diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c index c656d0162432..18529484c8dc 100644 --- a/sound/usb/caiaq/midi.c +++ b/sound/usb/caiaq/midi.c @@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre { struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data; if (cdev->midi_out_active) { - usb_kill_urb(&cdev->midi_out_urb); + usb_kill_urb(cdev->midi_out_urb); cdev->midi_out_active = 0; } return 0; @@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev, return; cdev->midi_out_buf[2] = len; - cdev->midi_out_urb.transfer_buffer_length = len+3; + cdev->midi_out_urb->transfer_buffer_length = len+3; - ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC); + ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC); if (ret < 0) dev_err(dev, "snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed," ^ permalink raw reply related [flat|nested] 15+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb 2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio @ 2026-09-03 9:44 ` Takashi Iwai 2026-09-03 11:07 ` DIY allocation or embedding of URBs in larger structures Michal Pecio 2026-09-03 9:55 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Hillf Danton 2026-09-03 10:01 ` syzbot 2 siblings, 1 reply; 15+ messages in thread From: Takashi Iwai @ 2026-09-03 9:44 UTC (permalink / raw) To: Michal Pecio Cc: syzbot, bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai, linux-sound On Thu, 03 Sep 2026 11:24:17 +0200, Michal Pecio wrote: > > On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote: > > syzbot has found a reproducer for the following issue on: > > > > HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:.. > > git tree: upstream > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30 > > dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d > > compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000 > > > > Downloadable assets: > > disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz > > vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz > > kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > > > > usb 1-1: received EP1 urb->status = -2 > > ================================================================== > > BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] > > BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] > > BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline] > > BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline] > > BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline] > > BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline] > > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 > > > > CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 > > Call Trace: > > <TASK> > > dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 > > print_address_description+0x55/0x1e0 mm/kasan/report.c:378 > > print_report+0x58/0x70 mm/kasan/report.c:482 > > kasan_report+0x117/0x150 mm/kasan/report.c:595 > > check_region_inline mm/kasan/generic.c:-1 [inline] > > kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200 > > instrument_atomic_read_write include/linux/instrumented.h:112 [inline] > > atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] > > __refcount_sub_and_test include/linux/refcount.h:389 [inline] > > __refcount_dec_and_test include/linux/refcount.h:432 [inline] > > refcount_dec_and_test include/linux/refcount.h:450 [inline] > > kref_put include/linux/kref.h:64 [inline] > > usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > > dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 > > __run_hrtimer kernel/time/hrtimer.c:2067 [inline] > > __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 > > hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 > > handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 > > __do_softirq kernel/softirq.c:679 [inline] > > run_ktimerd+0x6a/0x100 kernel/softirq.c:1183 > > smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 > > kthread+0x38b/0x470 kernel/kthread.c:436 > > ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 > > </TASK> > > [Adding sound people] > > So what happens here is that USB core continues to use a URB after > completion to implement things like usb_kill_urb(), so URBs are > reference counted. Then core decrements the count - one more use. > > If a driver waits for completion or even usb_kill_urb() to return > and then proceeds to free the URB's storage, this becomes a UAF. > This driver embeds 2 URBs in its priv and does just that. > > A URB can only exist as an independent allocation, core will free > it if upon finding zero reference count in such case. > > This is a mechanical conversion, untested. I don't have the HW. This should work, and we've received another similar patch submission already. So, IIUC, now the URB *must* be always allocated via usb_alloc_urb() and an embedded URB isn't allowed? If so, we'd need to address other drivers, too. thanks, Takashi ^ permalink raw reply [flat|nested] 15+ messages in thread
* DIY allocation or embedding of URBs in larger structures 2026-09-03 9:44 ` Takashi Iwai @ 2026-09-03 11:07 ` Michal Pecio 2026-09-03 14:37 ` Takashi Iwai 0 siblings, 1 reply; 15+ messages in thread From: Michal Pecio @ 2026-09-03 11:07 UTC (permalink / raw) To: Takashi Iwai Cc: syzbot, bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai, linux-sound On Thu, 03 Sep 2026 11:44:45 +0200, Takashi Iwai wrote: > On Thu, 03 Sep 2026 11:24:17 +0200, > Michal Pecio wrote: > > So what happens here is that USB core continues to use a URB after > > completion to implement things like usb_kill_urb(), so URBs are > > reference counted. Then core decrements the count - one more use. > > > > If a driver waits for completion or even usb_kill_urb() to return > > and then proceeds to free the URB's storage, this becomes a UAF. > > This driver embeds 2 URBs in its priv and does just that. > > > > A URB can only exist as an independent allocation, core will free > > it if upon finding zero reference count in such case. > > So, IIUC, now the URB *must* be always allocated via usb_alloc_urb() > and an embedded URB isn't allowed? If so, we'd need to address other > drivers, too. Yes, that's basically the case and actually has been for a long time. The only thing that works is for both USB and the driver to call usb_free_urb() and whoever does last will actually free the storage. This means URB can't share storage with anything else. Some drivers got away with making URB the first member of a struct which is freed together with it. AFAIK this pattern doesn't crash, but it's deprecated too because it puts a flexible member (in the URB) in the middle of (the outer) struct. This pattern here in caiaq has always been one race away from UAF. Maybe it wasn't very likely to happen, but stuff like PREEMPT_RT and hypervisors can insert unexpected delays anywhere these days. Greg KH puts it thusly: https://lore.kernel.org/linux-usb/2025120716-sway-hypnotic-8cb6@gregkh/ Reragds, Michal ^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: DIY allocation or embedding of URBs in larger structures 2026-09-03 11:07 ` DIY allocation or embedding of URBs in larger structures Michal Pecio @ 2026-09-03 14:37 ` Takashi Iwai 0 siblings, 0 replies; 15+ messages in thread From: Takashi Iwai @ 2026-09-03 14:37 UTC (permalink / raw) To: Michal Pecio Cc: Takashi Iwai, syzbot, bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai, linux-sound On Thu, 03 Sep 2026 13:07:57 +0200, Michal Pecio wrote: > > On Thu, 03 Sep 2026 11:44:45 +0200, Takashi Iwai wrote: > > On Thu, 03 Sep 2026 11:24:17 +0200, > > Michal Pecio wrote: > > > So what happens here is that USB core continues to use a URB after > > > completion to implement things like usb_kill_urb(), so URBs are > > > reference counted. Then core decrements the count - one more use. > > > > > > If a driver waits for completion or even usb_kill_urb() to return > > > and then proceeds to free the URB's storage, this becomes a UAF. > > > This driver embeds 2 URBs in its priv and does just that. > > > > > > A URB can only exist as an independent allocation, core will free > > > it if upon finding zero reference count in such case. > > > > So, IIUC, now the URB *must* be always allocated via usb_alloc_urb() > > and an embedded URB isn't allowed? If so, we'd need to address other > > drivers, too. > > Yes, that's basically the case and actually has been for a long time. > > The only thing that works is for both USB and the driver to call > usb_free_urb() and whoever does last will actually free the storage. > This means URB can't share storage with anything else. > > Some drivers got away with making URB the first member of a struct > which is freed together with it. AFAIK this pattern doesn't crash, but > it's deprecated too because it puts a flexible member (in the URB) in > the middle of (the outer) struct. > > This pattern here in caiaq has always been one race away from UAF. > Maybe it wasn't very likely to happen, but stuff like PREEMPT_RT and > hypervisors can insert unexpected delays anywhere these days. > > Greg KH puts it thusly: > https://lore.kernel.org/linux-usb/2025120716-sway-hypnotic-8cb6@gregkh/ OK, I'll send the fix patches for the rest of sound drivers. thanks, Takashi ^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb 2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio 2026-09-03 9:44 ` Takashi Iwai @ 2026-09-03 9:55 ` Hillf Danton 2026-09-03 10:01 ` syzbot 2 siblings, 0 replies; 15+ messages in thread From: Hillf Danton @ 2026-09-03 9:55 UTC (permalink / raw) To: Michal Pecio Cc: syzbot, linux-media, linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai, linux-sound On Thu, 3 Sep 2026 11:24:17 +0200 Michal Pecio wrote: >On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote: >> syzbot has found a reproducer for the following issue on: >> >> HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:.. >> git tree: upstream >> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30 >> dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d >> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000 >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000 >> >> Downloadable assets: >> disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz >> vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz >> kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz >> >> IMPORTANT: if you fix the issue, please add the following tag to the commit: >> Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com >> >> usb 1-1: received EP1 urb->status = -2 >> ================================================================== >> BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] >> BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] >> BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline] >> BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline] >> BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline] >> BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline] >> BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 >> Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 >> >> CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 >> Call Trace: >> <TASK> >> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 >> print_address_description+0x55/0x1e0 mm/kasan/report.c:378 >> print_report+0x58/0x70 mm/kasan/report.c:482 >> kasan_report+0x117/0x150 mm/kasan/report.c:595 >> check_region_inline mm/kasan/generic.c:-1 [inline] >> kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200 >> instrument_atomic_read_write include/linux/instrumented.h:112 [inline] >> atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] >> __refcount_sub_and_test include/linux/refcount.h:389 [inline] >> __refcount_dec_and_test include/linux/refcount.h:432 [inline] >> refcount_dec_and_test include/linux/refcount.h:450 [inline] >> kref_put include/linux/kref.h:64 [inline] >> usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 >> dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 >> __run_hrtimer kernel/time/hrtimer.c:2067 [inline] >> __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 >> hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 >> handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 >> __do_softirq kernel/softirq.c:679 [inline] >> run_ktimerd+0x6a/0x100 kernel/softirq.c:1183 >> smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 >> kthread+0x38b/0x470 kernel/kthread.c:436 >> ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 >> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 >> </TASK> > >[Adding sound people] > > So what happens here is that USB core continues to use a URB after > completion to implement things like usb_kill_urb(), so URBs are > reference counted. Then core decrements the count - one more use. > > If a driver waits for completion or even usb_kill_urb() to return > and then proceeds to free the URB's storage, this becomes a UAF. > This driver embeds 2 URBs in its priv and does just that. > Given dummy_urb_dequeue(), the dequeued urb should be tagged not to be handled again in the dummy_timer callback instead, just my $0.02 ^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb 2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio 2026-09-03 9:44 ` Takashi Iwai 2026-09-03 9:55 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Hillf Danton @ 2026-09-03 10:01 ` syzbot 2 siblings, 0 replies; 15+ messages in thread From: syzbot @ 2026-09-03 10:01 UTC (permalink / raw) To: bolewara, devnull, gregkh, linux-kernel, linux-media, linux-sound, linux-usb, mchehab, michal.pecio, syzkaller-bugs, tiwai, zonque Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Tested on: commit: 940de590 Merge tag 'hardening-v7.3-rc2' of git://git.k.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=13da7c15580000 kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30 dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=15527c15580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 15+ messages in thread
end of thread, other threads:[~2026-09-03 14:38 UTC | newest]
Thread overview: 15+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <6a6e9502.f794c993.27aeb.0018.GAE@google.com>
2026-09-02 5:09 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb syzbot
2026-09-03 8:47 ` [PATCH] ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev Edward Adam Davis
2026-09-03 9:32 ` Takashi Iwai
2026-09-03 9:41 ` Edward Adam Davis
2026-09-03 10:03 ` Takashi Iwai
2026-09-03 11:56 ` [PATCH v3] " Edward Adam Davis
2026-09-03 13:05 ` [PATCH v4] " Edward Adam Davis
2026-09-03 10:04 ` [PATCH v2] " Edward Adam Davis
2026-09-03 11:34 ` Michal Pecio
2026-09-03 9:24 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Michal Pecio
2026-09-03 9:44 ` Takashi Iwai
2026-09-03 11:07 ` DIY allocation or embedding of URBs in larger structures Michal Pecio
2026-09-03 14:37 ` Takashi Iwai
2026-09-03 9:55 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Hillf Danton
2026-09-03 10:01 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox