diff options
| author | Šerif Rami <ramiserifpersia@gmail.com> | 2025-08-19 21:51:33 +0300 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2025-08-20 08:22:23 +0300 |
| commit | 0c5e2ae204eca74e4ccbaffc8125c3b41de9c9b8 (patch) | |
| tree | 6cbc1281bbb28dbed2a5597e7b980cdb8326f605 | |
| parent | d9f0633867711cff87c5604a4f90daa8ab986e4f (diff) | |
| download | linux-0c5e2ae204eca74e4ccbaffc8125c3b41de9c9b8.tar.xz | |
ALSA: usb-audio: us144mkii: Fix null-deref in tascam_midi_in_urb_complete()
The smatch tool reported a potential null pointer dereference in
tascam_midi_in_urb_complete(). The 'tascam' variable, derived from
'urb->context', was checked for nullity in one place, but dereferenced
without a check in several other places.
This patch fixes the issue by adding a null check at the beginning of
the function. If 'tascam' is null, the function now safely exits.
This prevents any potential crashes from null pointer dereferences.
It also fixes a latent bug where 'usb_put_urb()' could
be called twice for the same URB on submission failure, which would
lead to a use-after-free error.
Fixes: 67afec157fe6 ("ALSA: usb-audio: us144mkii: Add MIDI support and mixer controls")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202508192109.lcMrINK1-lkp@intel.com/
Signed-off-by: Šerif Rami <ramiserifpersia@gmail.com>
Link: https://patch.msgid.link/20250819185133.10464-1-ramiserifpersia@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
| -rw-r--r-- | sound/usb/usx2y/us144mkii_midi.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/sound/usb/usx2y/us144mkii_midi.c b/sound/usb/usx2y/us144mkii_midi.c index 5759f601007f..08b04aa39278 100644 --- a/sound/usb/usx2y/us144mkii_midi.c +++ b/sound/usb/usx2y/us144mkii_midi.c @@ -41,6 +41,9 @@ void tascam_midi_in_urb_complete(struct urb *urb) struct tascam_card *tascam = urb->context; int ret; + if (!tascam) + goto out; + if (urb->status) { if (urb->status != -ENOENT && urb->status != -ECONNRESET && urb->status != -ESHUTDOWN && urb->status != -EPROTO) { @@ -51,7 +54,7 @@ void tascam_midi_in_urb_complete(struct urb *urb) goto out; } - if (tascam && atomic_read(&tascam->midi_in_active) && + if (atomic_read(&tascam->midi_in_active) && urb->actual_length > 0) { kfifo_in_spinlocked(&tascam->midi_in_fifo, urb->transfer_buffer, urb->actual_length, &tascam->midi_in_lock); @@ -65,8 +68,9 @@ void tascam_midi_in_urb_complete(struct urb *urb) dev_err(tascam->card->dev, "Failed to resubmit MIDI IN URB: error %d\n", ret); usb_unanchor_urb(urb); - usb_put_urb(urb); + goto out; } + out: usb_put_urb(urb); } |