diff options
| author | WenTao Liang <vulab@iscas.ac.cn> | 2026-06-27 12:29:49 +0800 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2026-06-29 12:17:18 +0200 |
| commit | 5cff1529a2f9b3461a7f5a6e36a86682fc290534 (patch) | |
| tree | 5450c0ec1416a590d26d1bf6a64eee7dda833958 /scripts/sbom/git@git.tavy.me:linux-stable.git | |
| parent | dc59e4fea9d83f03bad6bddf3fa2e52491777482 (diff) | |
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
In capture_urb_complete(), usb_anchor_urb() is called on every
completion callback, but the URB is already anchored from the
initial submission in tascam_trigger_start(). Each redundant call
corrupts the anchor's doubly-linked list and inflates the URB
refcount. When usb_kill_anchored_urbs() traverses the list during
stream stop / suspend / disconnect, the corrupted list leads to
use-after-free.
Remove the redundant usb_anchor_urb() from the resubmit path.
Cc: stable@vger.kernel.org
Fixes: c1bb0c13e430 ("ALSA: usb-audio: us144mkii: Implement audio capture and decoding")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260627042949.61767-1-vulab@iscas.ac.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'scripts/sbom/git@git.tavy.me:linux-stable.git')
0 files changed, 0 insertions, 0 deletions