]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list...
authorWenTao Liang <vulab@iscas.ac.cn>
Sat, 27 Jun 2026 04:29:49 +0000 (12:29 +0800)
committerTakashi Iwai <tiwai@suse.de>
Mon, 29 Jun 2026 10:17:18 +0000 (12:17 +0200)
commit5cff1529a2f9b3461a7f5a6e36a86682fc290534
tree5450c0ec1416a590d26d1bf6a64eee7dda833958
parentdc59e4fea9d83f03bad6bddf3fa2e52491777482
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

In capture_urb_complete(), usb_anchor_urb() is called on every
completion callback, but the URB is already anchored from the
initial submission in tascam_trigger_start(). Each redundant call
corrupts the anchor's doubly-linked list and inflates the URB
refcount. When usb_kill_anchored_urbs() traverses the list during
stream stop / suspend / disconnect, the corrupted list leads to
use-after-free.

Remove the redundant usb_anchor_urb() from the resubmit path.

Cc: stable@vger.kernel.org
Fixes: c1bb0c13e430 ("ALSA: usb-audio: us144mkii: Implement audio capture and decoding")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260627042949.61767-1-vulab@iscas.ac.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/usb/usx2y/us144mkii_capture.c