From: Takashi Iwai <tiwai@suse.de>
To: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Cc: zonque@gmail.com,
Linux List Kernel Mailing <linux-kernel@vger.kernel.org>,
alsa-devel@alsa-project.org, linux-usb@vger.kernel.org
Subject: Re: BUG: KASAN: use-after-free in snd_complete_urb+0x109e/0x1740 [snd_usb_audio] (5.11-rc6)
Date: Fri, 05 Feb 2021 23:25:35 +0100 [thread overview]
Message-ID: <s5hsg6a17a8.wl-tiwai@suse.de> (raw)
In-Reply-To: <CABXGCsOposU1A_HavA_jmtkJMKhDZgh5m1b_YJK1Es5wyE-hZw@mail.gmail.com>
On Fri, 05 Feb 2021 22:02:16 +0100,
Mikhail Gavrilov wrote:
>
> Hi folks.
> On 5.11-rc6 (git 3aaf0a27ffc2) I caught a new issue.
> For unknown reason sound disappeared in my headset Hyperx orbit s.
> But after reconnecting to another USB port headset stopped being
> detected as USB device in dmesg
> and in log appears a record about bug KASAN: use-after-free.
>
> [37920.370627] xhci_hcd 0000:06:00.3: AMD-Vi: Event logged
> [IO_PAGE_FAULT domain=0x0013 address=0xfe836480 flags=0x0000]
> [37920.370720] xhci_hcd 0000:06:00.3: WARNING: Host System Error
> [37925.514865] xhci_hcd 0000:06:00.3: xHCI host not responding to stop
> endpoint command.
> [37925.514875] xhci_hcd 0000:06:00.3: USBSTS: HCHalted HSE EINT HCE
> [37925.514883] xhci_hcd 0000:06:00.3: xHCI host controller not
> responding, assume dead
> [37925.515700] xhci_hcd 0000:06:00.3: HC died; cleaning up
> [37925.515760] usb 3-1: USB disconnect, device number 2
> [37925.515765] usb 3-1.1: USB disconnect, device number 5
> [37925.515896] ==================================================================
> [37925.515899] BUG: KASAN: use-after-free in
> snd_complete_urb+0x109e/0x1740 [snd_usb_audio]
> [37925.515919] Read of size 8 at addr ffff88813a264260 by task
> kworker/19:0/649395
>
> [37925.515926] CPU: 19 PID: 649395 Comm: kworker/19:0 Tainted: G
> W --------- ---
> 5.11.0-0.rc6.20210203git3aaf0a27ffc2.144.fc34.x86_64 #1
> [37925.515930] Hardware name: System manufacturer System Product
> Name/ROG STRIX X570-I GAMING, BIOS 3402 01/13/2021
> [37925.515934] Workqueue: usb_hub_wq hub_event
> [37925.515940] Call Trace:
> [37925.515943] <IRQ>
> [37925.515945] dump_stack+0xae/0xe5
> [37925.515955] print_address_description.constprop.0+0x18/0x160
> [37925.515960] ? snd_complete_urb+0x109e/0x1740 [snd_usb_audio]
(snip)
This must be a stray URB processed after the disconnection.
Does the patch below help?
thanks,
Takashi
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -127,6 +127,8 @@ static void snd_usb_stream_disconnect(struct snd_usb_stream *as)
subs = &as->substream[idx];
if (!subs->num_formats)
continue;
+ snd_usb_endpoint_sync_pending_stop(subs->sync_endpoint);
+ snd_usb_endpoint_sync_pending_stop(subs->data_endpoint);
subs->data_endpoint = NULL;
subs->sync_endpoint = NULL;
}
next prev parent reply other threads:[~2021-02-06 3:20 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-05 21:02 BUG: KASAN: use-after-free in snd_complete_urb+0x109e/0x1740 [snd_usb_audio] (5.11-rc6) Mikhail Gavrilov
2021-02-05 22:25 ` Takashi Iwai [this message]
[not found] ` <20210206054533.120-1-hdanton@sina.com>
2021-02-06 7:48 ` Takashi Iwai
2021-02-06 8:28 ` Takashi Iwai
2021-02-06 12:19 ` Takashi Iwai
[not found] <20210206081333.7472-1-hdanton@sina.com>
2021-02-06 8:32 ` Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=s5hsg6a17a8.wl-tiwai@suse.de \
--to=tiwai@suse.de \
--cc=alsa-devel@alsa-project.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mikhail.v.gavrilov@gmail.com \
--cc=zonque@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).