mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-22 13:15:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

ALSA: usb-audio: us144mkii: Fix null-deref in tascam_midi_in_urb_complete()

Browse Source 
The smatch tool reported a potential null pointer dereference in
tascam_midi_in_urb_complete(). The 'tascam' variable, derived from
'urb->context', was checked for nullity in one place, but dereferenced
without a check in several other places.

This patch fixes the issue by adding a null check at the beginning of
the function. If 'tascam' is null, the function now safely exits.
This prevents any potential crashes from null pointer dereferences.

It also fixes a latent bug where 'usb_put_urb()' could
be called twice for the same URB on submission failure, which would
lead to a use-after-free error.

Fixes: 67afec157f ("ALSA: usb-audio: us144mkii: Add MIDI support and mixer controls")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202508192109.lcMrINK1-lkp@intel.com/
Signed-off-by: Šerif Rami <ramiserifpersia@gmail.com>
Link: https://patch.msgid.link/20250819185133.10464-1-ramiserifpersia@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Šerif Rami
2025-08-19 20:51:33 +02:00
committed by Takashi Iwai
parent d9f0633867
commit 0c5e2ae204
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
sound/usb/usx2y/us144mkii_midi.c
View File

@@ -41,6 +41,9 @@ void tascam_midi_in_urb_complete(struct urb *urb)
struct tascam_card *tascam = urb->context;
int ret;
if (!tascam)
goto out;
if (urb->status) {
if (urb->status != -ENOENT && urb->status != -ECONNRESET &&
urb->status != -ESHUTDOWN && urb->status != -EPROTO) {
@@ -51,7 +54,7 @@ void tascam_midi_in_urb_complete(struct urb *urb)
goto out;
}
if (tascam && atomic_read(&tascam->midi_in_active) &&
if (atomic_read(&tascam->midi_in_active) &&
urb->actual_length > 0) {
kfifo_in_spinlocked(&tascam->midi_in_fifo, urb->transfer_buffer,
urb->actual_length, &tascam->midi_in_lock);
@@ -65,8 +68,9 @@ void tascam_midi_in_urb_complete(struct urb *urb)
dev_err(tascam->card->dev,
"Failed to resubmit MIDI IN URB: error %d\n", ret);
usb_unanchor_urb(urb);
usb_put_urb(urb);
goto out;
}
out:
usb_put_urb(urb);
}