From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83525CA5A for ; Wed, 29 Jul 2026 00:23:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785284635; cv=none; b=OIaVGVq1QVGQ/5CeNYucskgCIfKQO1jqAf29Lm7hYZCnRMBpz/LDxJhTRD96XOGC7k3j5oryJhijdNBnteLX9VKwFwN5C0s3AB6H4pgmOaxvwKlCqBfXp9Newq/yo7SzjFnMNEVY9teKIPPId+VOv/xgUKRMJ1/srPQEw9He2RE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785284635; c=relaxed/simple; bh=BQwtZ4wkF5S0F7WfVDgfzAEyK6GgwhFfBcFMZaGmqPA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sJ6VL2RF3gGkaO0KVIyN0Ray4x7+XMHidKdGNMUUqxxshU5+HWRWDaCayMyN+kAUmAVHEaM3xh3czrBwkIsw5mmtoxm4XUc/+bt6iKGqUWwmywdA7GNfiDgtdpjyTYbEqGq7fBhfPVj+4LPSKaqax1hxU3ahjYnhIDFEKqCParE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=rLrXUw52; arc=none smtp.client-ip=209.85.215.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="rLrXUw52" Received: by mail-pg1-f181.google.com with SMTP id 41be03b00d2f7-c9e30214d8fso262564a12.3 for ; Tue, 28 Jul 2026 17:23:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785284634; x=1785889434; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=LrVoGn4sblzpENqt/97YSRnRGJ1nhNOn2U1+M+l6hfk=; b=rLrXUw524At0XXkjG78WQYByrRmgSBDkLlS4PVsW9uyfbtI65ieRWrp9KMXQAlQE9V 60nqZl2rkELUN0Ncpgx0Z84bYa+mmwFeUhXW8KSDE9uEV0IyX3xuo/88QzH++zz7v2R4 RpYathRlRcCOk2l94+URnzsYOKyAMaNpRQNeFzi5f5kZrExTORd1auxG559JzVOEWdUH UVCmS7X49pyh0NJB4e+gTxZAPV3t7CoQ1WpuihSFikQDH9hDufYstO3VyMIV9TaFWKau 24IJJjghmL8CwB+1MPBF8rCdTDFuhNqLY1dLltSPNW1EQUDUCkiqeAdME0P/tO+FRcA6 GGyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785284634; x=1785889434; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=LrVoGn4sblzpENqt/97YSRnRGJ1nhNOn2U1+M+l6hfk=; b=jjLdiyc3sLhHMX6JcI/i2FxIKaIyb81I7jARWOVfc3pSKb3FPuENuK/6YaPOQdJsdF Wir5BcsrSmomRmeu0JJ1bUZdTC97HxDDrP81ATwUaawgzmsqzmE79YPRBZEq8FyBAHBC wForADM/aFOVEfno6rKLRJfySYWQJiQ/O73d7cdnIoZZyIRuI4XAP6Z/9OcE8NYfD2MZ 3fg5tvjtpBmujjZYCe1heRunCshzp6ePyFqrvjupVCkOiVHKDMKY0M1KMhbCNPXV4FlN ZM2LzGuE8Lac0XQcs5MC6Gitfoplshqr66jETIn+ZGC2sb/Zqz3nyVjX+tu6wvU31jYp wddg== X-Forwarded-Encrypted: i=1; AHgh+RqYn13qABKTFCSSmqGT9CireDstMrLpfYF8cQl50eOW5Ye27Nu7SsRgZrI+f3U3uVzLfIlIebuLbhqAyFQ=@vger.kernel.org X-Gm-Message-State: AOJu0YwmT9NgKZHXpdA+r+d6Jp44mfAPKHqeCNLF7TidIZSEzmsbyH8I GLJ2dx5BhSUAhjAaB65Uiv/eiKfrYzhl6rUzpGWwtGBTJhwJn3SzocJH X-Gm-Gg: AR+sD1348HrqxBSoVfWTXi5IzKkp+jFb82H0vbSF472w9g9mQ8anDuiM8/hJuX+JFVX slJ1S1fNVLdM732k3beJ3O2HIlaLMuqUutqICBkoX4xsNqI48DN8uQlQSJYE4ljMYSG7ODWabCW asrNzdbz8dDyMuRp5BLWT/3aV9HoEULZ1kmTKQGC7OrFEA16Clp9TcIpqhsi6rnUdHxYuk66/6N Ofnqr8+aa+N767tKMv72+Co0oejXNlh0DhYNzWPnCkr2L258YIK4WA8eg2YQLgsrNiGY4DSxI42 i3ty9Bgzz2m6KjLQ7sC23eIV7XJnUexQpK9nGaUxvfo7p1C9ziUjGalj2us2AP8F+EFMe9X8UuF GJwjapgxDdNThZUmeb3IE0SImKopNVNkt2Zb3Ts4Ner89tAt6nxoarCV2eBLiVqdiDcJZXNtRPd 30UC2l7rwXNfTGZhg74AW4rbdfvtKYlZJyb+Jw8OGF1BW36+RUjYY+6Fi8Z/yMEyRdPkrGu4ddC G3m6af8dmp/2VaFVL2AQ+OXjIhYK5kfYuRvifRMfCUv X-Received: by 2002:a05:6a21:3381:b0:3c0:b766:74f4 with SMTP id adf61e73a8af0-3c8ba484354mr5970148637.31.1785284633878; Tue, 28 Jul 2026 17:23:53 -0700 (PDT) Received: from deepanshu-kernel-hacker.. ([2405:201:682f:383f:4684:f08f:7d61:c1d3]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31504db2c4csm3015068eec.28.2026.07.28.17.23.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Jul 2026 17:23:53 -0700 (PDT) From: Deepanshu Kartikey To: perex@perex.cz, tiwai@suse.com Cc: kees@kernel.org, linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+b6cab840e6a85641c7ad@syzkaller.appspotmail.com Subject: [PATCH] ALSA: ump: Fix double-free of ump->out_cvts on legacy rawmidi attach failure Date: Wed, 29 Jul 2026 05:53:33 +0530 Message-ID: <20260729002333.11525-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit If snd_rawmidi_new() fails inside snd_ump_attach_legacy_rawmidi(), the error path frees ump->out_cvts but leaves the pointer dangling. Since ump->out_cvts is a field of the long-lived struct snd_ump_endpoint (not the rawmidi device that failed to be created), it gets freed a second time later during normal endpoint teardown, in snd_ump_endpoint_free(), invoked via snd_rawmidi_free()'s private_free callback when the sound card is released. This results in a KASAN double-free/invalid-free. Clear ump->out_cvts to NULL after freeing it on the error path, so the later unconditional kfree() in snd_ump_endpoint_free() becomes a harmless no-op. Reported-by: syzbot+b6cab840e6a85641c7ad@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b6cab840e6a85641c7ad Signed-off-by: Deepanshu Kartikey --- sound/core/ump.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/core/ump.c b/sound/core/ump.c index 70520c7ca293..632c13baf21e 100644 --- a/sound/core/ump.c +++ b/sound/core/ump.c @@ -1365,6 +1365,7 @@ int snd_ump_attach_legacy_rawmidi(struct snd_ump_endpoint *ump, &rmidi); if (err < 0) { kfree(ump->out_cvts); + ump->out_cvts = NULL; return err; } -- 2.43.0