From: Takashi Iwai <tiwai@suse.de>
To: syzbot <syzbot+f02665daa2abeef4a947@syzkaller.appspotmail.com>
Cc: aha310510@gmail.com, clemens@ladisch.de, hdanton@sina.com,
linux-kernel@vger.kernel.org, linux-sound@vger.kernel.org,
perex@perex.cz, syzkaller-bugs@googlegroups.com, tiwai@suse.de
Subject: Re: [syzbot] [sound?] [usb?] general protection fault in snd_usbmidi_do_output
Date: Sat, 27 Sep 2025 13:53:38 +0200 [thread overview]
Message-ID: <87ms6g9kn1.wl-tiwai@suse.de> (raw)
In-Reply-To: <68d7c285.050a0220.25d7ab.030b.GAE@google.com>
On Sat, 27 Sep 2025 12:55:01 +0200,
syzbot wrote:
>
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> KASAN: slab-use-after-free Read in snd_usbmidi_in_urb_complete
Another try.
#syz test upstream master
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1522,6 +1522,9 @@ static void snd_usbmidi_free(struct snd_usb_midi *umidi)
{
int i;
+ if (!umidi->disconnected)
+ snd_usbmidi_disconnect(&umidi->list);
+
for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) {
struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i];
if (ep->out)
next prev parent reply other threads:[~2025-09-27 11:53 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-27 4:41 [PATCH] ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free Jeongjun Park
2025-09-27 8:01 ` Takashi Iwai
2025-09-27 8:48 ` Jeongjun Park
2025-09-27 9:39 ` Takashi Iwai
2025-09-27 9:19 ` Hillf Danton
2025-09-27 10:03 ` [syzbot] [sound?] [usb?] general protection fault in snd_usbmidi_do_output syzbot
2025-09-27 10:29 ` Takashi Iwai
2025-09-27 10:55 ` syzbot
2025-09-27 11:53 ` Takashi Iwai [this message]
2025-09-27 14:30 ` syzbot
2025-09-27 15:50 ` Jeongjun Park
2025-09-27 16:17 ` syzbot
2025-09-27 10:36 ` Jeongjun Park
2025-09-27 11:52 ` Takashi Iwai
2025-09-27 12:15 ` Jeongjun Park
2025-09-27 15:41 ` Jeongjun Park
2025-09-27 16:07 ` Takashi Iwai
-- strict thread matches above, loose matches on Subject: below --
2025-09-22 16:54 syzbot
2025-09-23 0:48 ` Hillf Danton
2025-09-23 2:22 ` syzbot
2025-09-23 7:39 ` Hillf Danton
2025-09-23 9:48 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87ms6g9kn1.wl-tiwai@suse.de \
--to=tiwai@suse.de \
--cc=aha310510@gmail.com \
--cc=clemens@ladisch.de \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=perex@perex.cz \
--cc=syzbot+f02665daa2abeef4a947@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox