• Takashi Iwai's avatar
    ALSA: line6: Fix leftover URB at error-path during probe · c95072b3
    Takashi Iwai authored
    While line6_probe() may kick off URB for a control MIDI endpoint, the
    function doesn't clean up it properly at its error path.  This results
    in a leftover URB action that is eventually triggered later and causes
    an Oops like:
      general protection fault: 0000 [#1] PREEMPT SMP KASAN
      CPU: 1 PID: 0 Comm: swapper/1 Not tainted
      RIP: 0010:usb_fill_bulk_urb ./include/linux/usb.h:1619
      RIP: 0010:line6_start_listen+0x3fe/0x9e0 sound/usb/line6/driver.c:76
      Call Trace:
       <IRQ>
       line6_data_received+0x1f7/0x470 sound/usb/line6/driver.c:326
       __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779
       usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845
       dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965
       call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281
       ....
    
    Since the whole clean-up procedure is done in line6_disconnect()
    callback, we can simply call it in the error path instead of
    open-coding the whole again.  It'll fix such an issue automagically.
    
    The bug was spotted by syzkaller.
    
    Fixes: eedd0e95 ("ALSA: line6: Don't forget to call driver's destructor at error path")
    Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
    Tested-by: default avatarAndrey Konovalov <andreyknvl@google.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    c95072b3
driver.c 20.6 KB