[PATCH 2/2] ALSA: caiaq: unregister the input device when probe fails

[PATCH 2/2] ALSA: caiaq: unregister the input device when probe fails

[Nguyen Ngoc Thang]

setup_card() registers the input device, whose name and phys point into
struct snd_usb_caiaqdev, and then goes on to snd_card_register() and
snd_usb_caiaq_control_init(). If either fails, snd_probe() calls
snd_card_free(), which frees the device state but leaves the input
device registered: card_free() only clears the pointer, and the input
device is unregistered from snd_disconnect() alone. Reading its "uevent"
attribute afterwards dereferences freed memory:

  BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0
  Read of size 1 at addr ffff8880208f5043 by task caiaq/4967
   add_uevent_var+0x183/0x3a0
   input_dev_uevent+0x162/0x900
   dev_uevent+0x2f1/0x870
   uevent_show+0x1ca/0x3a0
   ...

Unregister the input device on the probe error path, as
snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when
no input device was registered.

Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that
makes snd_usb_caiaq_control_init() fail.

Fixes: 28abd224db4a ("ALSA: caiaq: Handle probe errors properly")
Cc: stable@vger.kernel.org
Reported-by: syzbot+2a123f6269da57ffefaa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2a123f6269da57ffefaa
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
 sound/usb/caiaq/device.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index 3d821fde4582..f604846ec6e6 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -562,6 +562,9 @@ static int snd_probe(struct usb_interface *intf,
 	ret = init_card(caiaqdev(card));
 	if (ret < 0) {
 		dev_err(&usb_dev->dev, "unable to init card! (ret=%d)\n", ret);
+#ifdef CONFIG_SND_USB_CAIAQ_INPUT
+		snd_usb_caiaq_input_disconnect(caiaqdev(card));
+#endif
 		snd_card_free(card);
 		return ret;
 	}
-- 
2.43.0

Re: [PATCH 2/2] ALSA: caiaq: unregister the input device when probe fails

[Takashi Iwai]

On Fri, 25 Sep 2026 19:07:17 +0200,
Nguyen Ngoc Thang wrote:
> 
> setup_card() registers the input device, whose name and phys point into
> struct snd_usb_caiaqdev, and then goes on to snd_card_register() and
> snd_usb_caiaq_control_init(). If either fails, snd_probe() calls
> snd_card_free(), which frees the device state but leaves the input
> device registered: card_free() only clears the pointer, and the input
> device is unregistered from snd_disconnect() alone. Reading its "uevent"
> attribute afterwards dereferences freed memory:
> 
>   BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0
>   Read of size 1 at addr ffff8880208f5043 by task caiaq/4967
>    add_uevent_var+0x183/0x3a0
>    input_dev_uevent+0x162/0x900
>    dev_uevent+0x2f1/0x870
>    uevent_show+0x1ca/0x3a0
>    ...
> 
> Unregister the input device on the probe error path, as
> snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when
> no input device was registered.
> 
> Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that
> makes snd_usb_caiaq_control_init() fail.
> 
> Fixes: 28abd224db4a ("ALSA: caiaq: Handle probe errors properly")
> Cc: stable@vger.kernel.org
> Reported-by: syzbot+2a123f6269da57ffefaa@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2a123f6269da57ffefaa
> Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>

Applied now.  Thanks.


Takashi