ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list...

In capture_urb_complete(), usb_anchor_urb() is called on every
completion callback, but the URB is already anchored from the
initial submission in tascam_trigger_start(). Each redundant call
corrupts the anchor's doubly-linked list and inflates the URB
refcount. When usb_kill_anchored_urbs() traverses the list during
stream stop / suspend / disconnect, the corrupted list leads to
use-after-free.

Remove the redundant usb_anchor_urb() from the resubmit path.

Cc: stable@vger.kernel.org
Fixes: c1bb0c13e430 ("ALSA: usb-audio: us144mkii: Implement audio capture and decoding")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260627042949.61767-1-vulab@iscas.ac.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/usb/usx2y/us144mkii_capture.c b/sound/usb/usx2y/us144mkii_capture.c
index af120bf621733499e632384e9691c7810a72f202..fa01da98151aadcbcbbbb5345894563de0c716b9 100644 (file)
--- a/sound/usb/usx2y/us144mkii_capture.c
+++ b/sound/usb/usx2y/us144mkii_capture.c
@@ -302,7 +302,6 @@ void capture_urb_complete(struct urb *urb)
        }
 
        usb_get_urb(urb);
-       usb_anchor_urb(urb, &tascam->capture_anchor);
        ret = usb_submit_urb(urb, GFP_ATOMIC);
        if (ret < 0) {
                dev_err_ratelimited(tascam->card->dev,
@@ -312,6 +311,7 @@ void capture_urb_complete(struct urb *urb)
                usb_put_urb(urb);
                atomic_dec(
                        &tascam->active_urbs); /* Decrement on failed resubmission */
+               return;
        }
 out:
        usb_put_urb(urb);