diff options
| author | Takashi Iwai <tiwai@suse.de> | 2026-09-03 18:04:38 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2026-09-06 10:01:42 +0200 |
| commit | 7a8e247dab54a42aeec0240153c55da286ac5aef (patch) | |
| tree | df6fa7e8a2e7911de7911d408fa89d166ee3c4eb /scripts | |
| parent | 07b01b0d8ac4b5f89cbe74e52376221f21db260d (diff) | |
| download | linux-7a8e247dab54a42aeec0240153c55da286ac5aef.tar.gz linux-7a8e247dab54a42aeec0240153c55da286ac5aef.zip | |
ALSA: usb: hiface: Avoid embedded URBs
The hiface driver uses URBs embedded in struct pcm_urb, and this is
basically a buggy implementation nowadays; since a URB is managed with
a refcount, this may lead to a UAF when the URB is released
asynchronously.
For addressing the problem, this patch converts the embedded URBs to
ones that are properly allocated via usb_alloc_urb().
The conversion is rather straightforward; pcm_urb.instance became a
pointer, assigned/freed via usb_alloc_urb() and usb_free_urb(), and
the call with this is corrected accordingly.
Along with it, the resource release is done in the common destructor
that is called from both at the error path and the disconnect.
No functional changes, only compile-tested.
Link: https://lore.kernel.org/20260903130757.0668310a.michal.pecio@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260903160458.1938392-3-tiwai@suse.de
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions
