Re: [BUG] ALSA: ump: NULL deref of legacy_rmidi after parse sets parsed

[Takashi Iwai <tiwai@suse.de>]

On Wed, 02 Sep 2026 08:58:34 +0200,
Qingyu Zhang wrote:
> 
> Dear Takashi,
> 
> Thank you for your email. The formatted patch with the Signed-off-by
> tag is attached; please check.

The Signed-off-by tag must be with a real name (or a known identity).
Please resubmit with the corrected tag.  And, at best, not as an
attachment to this thread, but a new thread via git-send-email or
such.


thanks,

Takashi

> 
> Yours,
> Ian
> 
> >
> > On Wed, 02 Sep 2026 04:07:30 +0200,
> > Qingyu Zhang wrote:
> > >
> > > Hello,
> > >
> > > ump_legacy_set_rawmidi_name() snprintf()s into ump->legacy_rmidi->name
> > > when ump->parsed is true, but parsed is set at the end of
> > > snd_ump_parse_endpoint() *before* snd_ump_attach_legacy_rawmidi().
> > > A UMP packet in that window NULL-derefs.
> > >
> > > Type: null-pointer dereference
> > >
> > > * Summary
> > >
> > > snd_ump_parse_endpoint() always does:
> > >
> > >        error:
> > >                ump->parsed = true;
> > >                ...
> > >
> > > ump_handle_ep_name_msg():
> > >
> > >        if (ret && ump->parsed) {
> > >                ump_set_rawmidi_name(ump);
> > >                ump_legacy_set_rawmidi_name(ump);  /* rmidi may be NULL */
> > >        }
> > >
> > > ump_legacy_set_rawmidi_name():
> > >
> > >        rmidi = ump->legacy_rmidi;
> > >        snprintf(rmidi->name, ...);   /* no NULL check */
> > >
> > > This runs from snd_ump_receive() on the USB input URB complete path
> > > (in interrupt).
> > >
> > > * Affected
> > >
> > > 37e0e14128e0. Needs CONFIG_SND_UMP, CONFIG_SND_UMP_LEGACY_RAWMIDI,
> > > CONFIG_SND_USB_AUDIO, a MIDI 2.0 gadget or device. KASAN.
> > >
> > > The natural window is parse-done vs attach. The QEMU PoC widens it
> > > with a kprobe on snd_ump_receive (poc/widen_ump.c) plus dummy_hcd
> > > configfs midi2, because the un-widened window is short.
> > >
> > > * Reproduction
> > >
> > >        # dummy_hcd + configfs usb_gadget midi2.usb0 (see poc/run.sh)
> > >        # with widen_ump.ko: force parsed=1, legacy_rmidi=NULL on receive
> > >
> > > KASAN: null-ptr-deref in snprintf from ump_legacy_set_rawmidi_name
> > > <- ump_handle_ep_name_msg <- snd_ump_receive <- input_urb_complete.
> > > Then "Fatal exception in interrupt".
> > >
> > > * Expected
> > >
> > > legacy_rmidi helpers no-op until attach has stored the pointer.
> > >
> > > * Actual
> > >
> > > IRQ-context NULL deref.
> > >
> > > Please consider the suggested patch
> > >
> > > Thanks.
> > >
> > > Suggested patch:
> > > ```
> > > diff --git a/sound/core/ump.c b/sound/core/ump.c
> > > index d183c8a000bd..3d1a2ed3b476 100644
> > > --- a/sound/core/ump.c
> > > +++ b/sound/core/ump.c
> > > @@ -1335,6 +1335,8 @@ static void update_legacy_names(struct
> > > snd_ump_endpoint *ump)
> > > {
> > >     struct snd_rawmidi *rmidi = ump->legacy_rmidi;
> > >
> > > +    if (!rmidi)
> > > +        return;
> > >     update_legacy_substreams(ump, rmidi, SNDRV_RAWMIDI_STREAM_INPUT);
> > >     update_legacy_substreams(ump, rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT);
> > > }
> > > @@ -1343,6 +1345,8 @@ static void ump_legacy_set_rawmidi_name(struct
> > > snd_ump_endpoint *ump)
> > > {
> > >     struct snd_rawmidi *rmidi = ump->legacy_rmidi;
> > >
> > > +    if (!rmidi)
> > > +        return;
> > >     snprintf(rmidi->name, sizeof(rmidi->name), "%.68s (MIDI 1.0)",
> > >          ump->core.name);
> > > }
> > > ```
> >
> > Thanks for the report.  The suggested code change looks good.
> > Could you submit a patch in the proper format for upstreaming
> > (especially with your Signed-off-by tag)?
> >
> >
> > thanks,
> >
> > Takashi
> From: Ian <usupergate@gmail.com>
> Date: Mon, 31 Aug 2026 17:00:00 +0800
> Subject: [PATCH] ALSA: ump: do not touch legacy_rmidi before it exists
> 
> snd_ump_parse_endpoint() sets ump->parsed on every exit, including
> error, before the caller attaches the legacy rawmidi device.
> ump_handle_ep_name_msg() then treats parsed as "legacy_rmidi is live"
> and calls ump_legacy_set_rawmidi_name(), which snprintf()s into
> ump->legacy_rmidi->name. If a UMP packet arrives in that window
> (IRQ path from snd_ump_receive), legacy_rmidi is still NULL
> (KASAN null-ptr-deref in snprintf).
> 
> Guard the legacy helpers. parsed only means endpoint info was
> parsed, not that legacy_rmidi exists.
> 
> Fixes: 37e0e14128e0 ("ALSA: ump: Support UMP Endpoint and Function Block parsing")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ian <usupergate@gmail.com>
> ---
> diff --git a/sound/core/ump.c b/sound/core/ump.c
> index d183c8a000bd..3d1a2ed3b476 100644
> --- a/sound/core/ump.c
> +++ b/sound/core/ump.c
> @@ -1335,6 +1335,8 @@ static void update_legacy_names(struct snd_ump_endpoint *ump)
>  {
>  	struct snd_rawmidi *rmidi = ump->legacy_rmidi;
>  
> +	if (!rmidi)
> +		return;
>  	update_legacy_substreams(ump, rmidi, SNDRV_RAWMIDI_STREAM_INPUT);
>  	update_legacy_substreams(ump, rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT);
>  }
> @@ -1343,6 +1345,8 @@ static void ump_legacy_set_rawmidi_name(struct snd_ump_endpoint *ump)
>  {
>  	struct snd_rawmidi *rmidi = ump->legacy_rmidi;
>  
> +	if (!rmidi)
> +		return;
>  	snprintf(rmidi->name, sizeof(rmidi->name), "%.68s (MIDI 1.0)",
>  		 ump->core.name);
>  }