linux/sound/usb
Takashi Iwai 0665886ad1 ALSA: usb-audio: Clear MIDI port active flag after draining
When a rawmidi output stream is closed, it calls the drain at first,
then does trigger-off only when the drain returns -ERESTARTSYS as a
fallback.  It implies that each driver should turn off the stream
properly after the drain.  Meanwhile, USB-audio MIDI interface didn't
change the port->active flag after the drain.  This may leave the
output work picking up the port that is closed right now, which
eventually leads to a use-after-free for the already released rawmidi
object.

This patch fixes the bug by properly clearing the port->active flag
after the output drain.

Reported-by: syzbot+70e777a39907d6d5fd0a@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/00000000000011555605dceaff03@google.com
Link: https://lore.kernel.org/r/20220420130247.22062-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-04-20 15:13:45 +02:00
..
6fire ALSA: 6fire: fix control and bulk message timeouts 2021-10-26 08:12:02 +02:00
bcd2000 ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
caiaq module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
hiface module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
line6 ALSA: line6: fix control and interrupt message timeouts 2021-10-26 08:12:14 +02:00
misc ALSA: ua101: fix division by zero at probe 2021-10-27 08:23:30 +02:00
usx2y ALSA: Fix some typo 2021-12-06 10:04:05 +01:00
card.c ALSA: usb-audio: Drop CONFIG_PM ifdefs 2021-12-06 10:19:40 +01:00
card.h ALSA: usb-audio: Improved lowlatency playback support 2021-09-30 13:55:24 +02:00
clock.c ALSA: usb-audio: fix null pointer dereference on pointer cs_desc 2021-10-26 08:05:23 +02:00
clock.h ALSA: usb-audio: Constify audioformat pointer references 2020-11-23 15:15:36 +01:00
endpoint.c ALSA: usb-audio: Fix packet size calculation regression 2021-10-01 12:54:56 +02:00
endpoint.h ALSA: usb-audio: Avoid killing in-flight URBs during draining 2021-09-30 13:55:26 +02:00
format.c ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID 2021-12-02 09:39:04 +01:00
format.h ALSA: usb: initial USB Audio Device Class 3.0 support 2018-03-21 11:46:33 +01:00
helper.c ALSA: usb-audio: Add snd_usb_get_host_interface() helper 2020-11-23 15:13:47 +01:00
helper.h ALSA: usb-audio: Add snd_usb_get_host_interface() helper 2020-11-23 15:13:47 +01:00
implicit.c ALSA: usb-audio: revert to IMPLICIT_FB_FIXED_DEV for M-Audio FastTrack Ultra 2022-02-14 09:45:02 +01:00
implicit.h ALSA: usb-audio: Factor out the implicit feedback quirk code 2020-11-23 15:17:00 +01:00
Kconfig sound: Fix Kconfig indentation 2019-10-07 03:53:03 +02:00
Makefile ALSA: usb-audio: Factor out the implicit feedback quirk code 2020-11-23 15:17:00 +01:00
media.c ALSA: usb-audio: fix spelling mistakes 2021-07-05 19:33:54 +02:00
media.h media: sound/usb: Use Media Controller API to share media resources 2019-04-22 11:21:06 -04:00
midi.c ALSA: usb-audio: Clear MIDI port active flag after draining 2022-04-20 15:13:45 +02:00
midi.h ALSA: usb-audio: generate midi streaming substream names from jack names 2021-03-01 09:21:54 +01:00
mixer_maps.c ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX. 2022-04-19 09:02:33 +02:00
mixer_quirks.c ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB 2022-03-12 08:50:43 +01:00
mixer_quirks.h ALSA: usb-audio: Drop CONFIG_PM ifdefs 2021-12-06 10:19:40 +01:00
mixer_s1810c.c ALSA: usb-audio: remove redundant assignment to variable c 2022-02-08 08:21:32 +01:00
mixer_s1810c.h ALSA: usb-audio: Add support for Presonus Studio 1810c 2020-02-15 09:46:16 +01:00
mixer_scarlett_gen2.c ALSA: scarlett2: Add support for the internal "standalone" switch 2022-03-08 10:05:48 +01:00
mixer_scarlett_gen2.h ALSA: usb-audio: scarlett2: Improve driver startup messages 2021-05-21 16:22:52 +02:00
mixer_scarlett.c ALSA: usb-audio: fix spelling mistakes 2021-07-05 19:33:54 +02:00
mixer_scarlett.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mixer_us16x08.c ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
mixer_us16x08.h ALSA: usb: Constify snd_kcontrol_new items 2020-01-03 09:24:34 +01:00
mixer.c ALSA: usb-audio: Don't abort resume upon errors 2022-02-14 13:57:51 +01:00
mixer.h ALSA: usb-audio: Drop CONFIG_PM ifdefs 2021-12-06 10:19:40 +01:00
pcm.c ALSA: usb-audio: Limit max buffer and period sizes per time 2022-04-13 09:10:56 +02:00
pcm.h ALSA: usb-audio: Make snd_usb_pcm_delay() static 2021-06-02 09:01:17 +02:00
power.c ALSA: usb-audio: More validations of descriptor units 2019-08-22 10:35:59 +02:00
power.h ALSA: usb-audio: Drop CONFIG_PM ifdefs 2021-12-06 10:19:40 +01:00
proc.c ALSA: usb-audio: Show sync endpoint information in proc outputs 2020-11-23 15:16:45 +01:00
proc.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
quirks-table.h ALSA: usb-audio: Correct quirk for VF0770 2022-02-01 08:11:50 +01:00
quirks.c ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID 2021-12-02 09:39:04 +01:00
quirks.h ALSA: usb-audio: Move interface setup delay into quirk_flags 2021-08-02 09:06:02 +02:00
stream.c ALSA: usb-audio: Move tx_length quirk handling to quirk_flags 2021-08-02 09:05:57 +02:00
stream.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
usbaudio.h ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant 2022-04-05 18:22:13 +02:00
validate.c ALSA: usb-audio: Fix endianess in descriptor validation 2020-02-01 09:06:11 +01:00