Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 30 Sep 2022 12:00:34 +0200
Message-ID: <874jwp6v25.wl-tiwai@suse.de>
From:   Takashi Iwai <tiwai@suse.de>
To:     "Sabri N. Ferreiro" <snferreiro1@gmail.com>
Cc:     perex@perex.cz, tiwai@suse.com, alsa-devel@alsa-project.org,
        linux-kernel@vger.kernel.org
Subject: Re: general protection fault in release_urbs
In-Reply-To: <877d1l6w20.wl-tiwai@suse.de>
References: <CAKG+3NRjTey+fFfUEGwuxL-pi_=T4cUskYG9OzpzHytF+tzYng@mail.gmail.com>
        <87bkqx6ws6.wl-tiwai@suse.de>
        <877d1l6w20.wl-tiwai@suse.de>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.2 Mule/6.0
MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue")
Content-Type: text/plain; charset=US-ASCII
Precedence: bulk

On Fri, 30 Sep 2022 11:39:03 +0200,
Takashi Iwai wrote:
> 
> On Fri, 30 Sep 2022 11:23:21 +0200,
> Takashi Iwai wrote:
> > 
> > On Fri, 30 Sep 2022 04:23:23 +0200,
> > Sabri N. Ferreiro wrote:
> > > 
> > > Hi,
> > > 
> > > When I used fuzz testing to test Linux kernel 6.0.0-rc6, the kernel
> > > triggered the following error:
> > > HEAD commit: 521a547ced6477c54b4b0cc206000406c221b4d6
> > > git tree: upstream
> > 
> > Could you retest with 6.0-rc7 or later?
> > A commit reverting the change might influence on the behavior
> > significantly.
> 
> And if it's reproducible on 6.0-rc7, please try the following fix.

... and I believe it's happening no matter which version.
I'm going to submit the proper patch, in anyway.


thanks,

Takashi

> 
> 
> thanks,
> 
> Takashi
> 
> -- 8< --
> --- a/sound/usb/endpoint.c
> +++ b/sound/usb/endpoint.c
> @@ -95,12 +95,13 @@ static inline unsigned get_usb_high_speed_rate(unsigned int rate)
>   */
>  static void release_urb_ctx(struct snd_urb_ctx *u)
>  {
> -	if (u->buffer_size)
> +	if (u->urb && u->buffer_size)
>  		usb_free_coherent(u->ep->chip->dev, u->buffer_size,
>  				  u->urb->transfer_buffer,
>  				  u->urb->transfer_dma);
>  	usb_free_urb(u->urb);
>  	u->urb = NULL;
> +	u->buffer_size = 0;
>  }
>  
>  static const char *usb_error_string(int err)