From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-usb-owner@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-7.2 required=3.0 tests=BAYES_00,DATE_IN_PAST_03_06,
	HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,
	SPF_PASS autolearn=no autolearn_force=no version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 91C91C433E0
	for <linux-usb@archiver.kernel.org>; Sat,  6 Feb 2021 03:20:38 +0000 (UTC)
Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
	by mail.kernel.org (Postfix) with ESMTP id 6274E64F99
	for <linux-usb@archiver.kernel.org>; Sat,  6 Feb 2021 03:20:38 +0000 (UTC)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S230495AbhBFDUE (ORCPT <rfc822;linux-usb@archiver.kernel.org>);
        Fri, 5 Feb 2021 22:20:04 -0500
Received: from mx2.suse.de ([195.135.220.15]:55378 "EHLO mx2.suse.de"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S231609AbhBFDOc (ORCPT <rfc822;linux-usb@vger.kernel.org>);
        Fri, 5 Feb 2021 22:14:32 -0500
X-Virus-Scanned: by amavisd-new at test-mx.suse.de
Received: from relay2.suse.de (unknown [195.135.221.27])
        by mx2.suse.de (Postfix) with ESMTP id 4116CADE0;
        Fri,  5 Feb 2021 22:25:35 +0000 (UTC)
Date:   Fri, 05 Feb 2021 23:25:35 +0100
Message-ID: <s5hsg6a17a8.wl-tiwai@suse.de>
From:   Takashi Iwai <tiwai@suse.de>
To:     Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Cc:     zonque@gmail.com,
        Linux List Kernel Mailing <linux-kernel@vger.kernel.org>,
        alsa-devel@alsa-project.org, linux-usb@vger.kernel.org
Subject: Re: BUG: KASAN: use-after-free in snd_complete_urb+0x109e/0x1740 [snd_usb_audio] (5.11-rc6)
In-Reply-To: <CABXGCsOposU1A_HavA_jmtkJMKhDZgh5m1b_YJK1Es5wyE-hZw@mail.gmail.com>
References: <CABXGCsOposU1A_HavA_jmtkJMKhDZgh5m1b_YJK1Es5wyE-hZw@mail.gmail.com>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka)
 FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3
 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Precedence: bulk
List-ID: <linux-usb.vger.kernel.org>
X-Mailing-List: linux-usb@vger.kernel.org

On Fri, 05 Feb 2021 22:02:16 +0100,
Mikhail Gavrilov wrote:
> 
> Hi folks.
> On 5.11-rc6 (git 3aaf0a27ffc2) I caught a new issue.
> For unknown reason sound disappeared in my headset Hyperx orbit s.
> But after reconnecting to another USB port headset stopped being
> detected as USB device in dmesg
> and in log appears a record about bug KASAN: use-after-free.
> 
> [37920.370627] xhci_hcd 0000:06:00.3: AMD-Vi: Event logged
> [IO_PAGE_FAULT domain=0x0013 address=0xfe836480 flags=0x0000]
> [37920.370720] xhci_hcd 0000:06:00.3: WARNING: Host System Error
> [37925.514865] xhci_hcd 0000:06:00.3: xHCI host not responding to stop
> endpoint command.
> [37925.514875] xhci_hcd 0000:06:00.3: USBSTS: HCHalted HSE EINT HCE
> [37925.514883] xhci_hcd 0000:06:00.3: xHCI host controller not
> responding, assume dead
> [37925.515700] xhci_hcd 0000:06:00.3: HC died; cleaning up
> [37925.515760] usb 3-1: USB disconnect, device number 2
> [37925.515765] usb 3-1.1: USB disconnect, device number 5
> [37925.515896] ==================================================================
> [37925.515899] BUG: KASAN: use-after-free in
> snd_complete_urb+0x109e/0x1740 [snd_usb_audio]
> [37925.515919] Read of size 8 at addr ffff88813a264260 by task
> kworker/19:0/649395
> 
> [37925.515926] CPU: 19 PID: 649395 Comm: kworker/19:0 Tainted: G
>  W        --------- ---
> 5.11.0-0.rc6.20210203git3aaf0a27ffc2.144.fc34.x86_64 #1
> [37925.515930] Hardware name: System manufacturer System Product
> Name/ROG STRIX X570-I GAMING, BIOS 3402 01/13/2021
> [37925.515934] Workqueue: usb_hub_wq hub_event
> [37925.515940] Call Trace:
> [37925.515943]  <IRQ>
> [37925.515945]  dump_stack+0xae/0xe5
> [37925.515955]  print_address_description.constprop.0+0x18/0x160
> [37925.515960]  ? snd_complete_urb+0x109e/0x1740 [snd_usb_audio]
(snip)

This must be a stray URB processed after the disconnection.
Does the patch below help?


thanks,

Takashi

--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -127,6 +127,8 @@ static void snd_usb_stream_disconnect(struct snd_usb_stream *as)
 		subs = &as->substream[idx];
 		if (!subs->num_formats)
 			continue;
+		snd_usb_endpoint_sync_pending_stop(subs->sync_endpoint);
+		snd_usb_endpoint_sync_pending_stop(subs->data_endpoint);
 		subs->data_endpoint = NULL;
 		subs->sync_endpoint = NULL;
 	}