[PATCH] fix: sound/usb/usx2y: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

[PATCH] fix: sound/usb/usx2y: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

[WenTao Liang]

In capture_urb_complete(), usb_anchor_urb() is called on every
completion callback, but the URB is already anchored from the
initial submission in tascam_trigger_start(). Each redundant call
corrupts the anchor's doubly-linked list and inflates the URB
refcount. When usb_kill_anchored_urbs() traverses the list during
stream stop / suspend / disconnect, the corrupted list leads to
use-after-free.

Remove the redundant usb_anchor_urb() from the resubmit path.

Cc: stable@vger.kernel.org
Fixes: c1bb0c13e430 ("ALSA: usb-audio: us144mkii: Implement audio capture and decoding")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 sound/usb/usx2y/us144mkii_capture.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/usb/usx2y/us144mkii_capture.c b/sound/usb/usx2y/us144mkii_capture.c
index af120bf62173..fa01da98151a 100644
--- a/sound/usb/usx2y/us144mkii_capture.c
+++ b/sound/usb/usx2y/us144mkii_capture.c
@@ -302,7 +302,6 @@ void capture_urb_complete(struct urb *urb)
 	}
 
 	usb_get_urb(urb);
-	usb_anchor_urb(urb, &tascam->capture_anchor);
 	ret = usb_submit_urb(urb, GFP_ATOMIC);
 	if (ret < 0) {
 		dev_err_ratelimited(tascam->card->dev,
@@ -312,6 +311,7 @@ void capture_urb_complete(struct urb *urb)
 		usb_put_urb(urb);
 		atomic_dec(
 			&tascam->active_urbs); /* Decrement on failed resubmission */
+		return;
 	}
 out:
 	usb_put_urb(urb);
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] fix: sound/usb/usx2y: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

[Takashi Iwai]

On Sat, 27 Jun 2026 06:29:49 +0200,
WenTao Liang wrote:
> 
> In capture_urb_complete(), usb_anchor_urb() is called on every
> completion callback, but the URB is already anchored from the
> initial submission in tascam_trigger_start(). Each redundant call
> corrupts the anchor's doubly-linked list and inflates the URB
> refcount. When usb_kill_anchored_urbs() traverses the list during
> stream stop / suspend / disconnect, the corrupted list leads to
> use-after-free.
> 
> Remove the redundant usb_anchor_urb() from the resubmit path.
> 
> Cc: stable@vger.kernel.org
> Fixes: c1bb0c13e430 ("ALSA: usb-audio: us144mkii: Implement audio capture and decoding")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>

Applied now.  But, at the next time, please try to adjust the subject
prefix; for sound/usb, it's "ALSA:"


thanks,

Takashi