[PATCH 0/5] ALSA: usx2y: us144mkii: fix PCM stream lifetime bugs

[Alexandre Becholey <alex@becholey.ch>]

Hi,

Five bugs in the snd-usb-us144mkii PCM code, all reproduced with an
emulated US-144MKII under KASAN on torvalds/master and v7.3.1:

 1/5 stop_pcm_work calls snd_pcm_stop() on a substream that is being
     closed (use-after-free of the runtime); the device can schedule
     the work at any time by sending bad feedback.
 2/5 capture_work keeps using the capture runtime after the capture
     PCM is closed while playback is running (use-after-free).
 3/5 the capture work and the playback URB completion use the buffer
     of a substream that was never started (NULL dma_area), because
     the URBs of both directions always run together.
 4/5 the playback and feedback URB completions use the substream
     runtime and buffer without waiting for close (use-after-free).
 5/5 a START retried while stop_work runs submits URBs that are still
     in flight (URB submitted while active, anchor list corruption).

The patches depend on each other and are meant to be applied in this
order: 2/5 builds on the close callback of 1/5, the check added in 3/5
is only safe once 2/5 guarantees that the capture work does not outlive
the substream, and 4/5 and 5/5 apply on top of the first three. In
testing, 3/5 without 2/5 crashed in the new check, and 1/5 + 2/5
without 3/5 still crashed on the NULL dma_area. Each patch has its
testing notes below its '---' line.

Hanxiang Xu reported the bugs fixed by 1/5, 2/5 and 4/5 on this list
on 2026-11-13, from source inspection and without a patch; we found
them independently with emulated devices. This series is sent as a
reply to that report, and 1/5, 2/5 and 4/5 carry Closes: tags for the
two messages. The reports also mention close racing with disconnect:
that concerns a fix that kills URBs in .close, which this series does
not do (the .close callbacks only touch the card private data), so
nothing is changed for it.

How we found it: the bugs were found, and the reproducers and these
patches were written, by AI agents (Claude Mythos and Claude Opus
models), in QEMU with emulated USB devices (raw-gadget/dummy_hcd,
emulated xHCI, USB/IP).
A human reviewed the analysis and the patches. The reproducers are
available on request.

Thanks,
Alexandre Becholey

Alexandre Becholey (5):
  ALSA: usx2y: us144mkii: fix stop_pcm_work race with PCM close
  ALSA: usx2y: us144mkii: wait for the capture work on capture close
  ALSA: usx2y: us144mkii: only touch the buffer of a running PCM stream
  ALSA: usx2y: us144mkii: wait for the URB completion handlers on stop and close
  ALSA: usx2y: us144mkii: do not restart the stream while stop_work runs

 sound/usb/usx2y/us144mkii.c          |   5 +-
 sound/usb/usx2y/us144mkii.h          |   2 +
 sound/usb/usx2y/us144mkii_capture.c  |  22 ++++-
 sound/usb/usx2y/us144mkii_pcm.c      | 162 +++++++++++++++++++----------------
 sound/usb/usx2y/us144mkii_pcm.h      |   8 ++
 sound/usb/usx2y/us144mkii_playback.c |  65 ++++++++++----
 6 files changed, 170 insertions(+), 94 deletions(-)