Re: [PATCH v2 1/2] ALSA: caiaq: fix use-after-free and double-free in setup_card()

[Takashi Iwai]

On Mon, 13 Apr 2026 05:49:40 +0200,
Berk Cem Goksel wrote:
> 
> When snd_card_register() fails in setup_card(), snd_card_free() is
> called on the card, but there is no return statement afterwards.
> Execution falls through to snd_usb_caiaq_control_init(cdev), which
> dereferences members of the just-freed card, resulting in a
> use-after-free.
> 
> setup_card() is void and init_card() still returns 0 on this path,
> so snd_probe() leaves the freed card pointer in the USB interface's
> private data via usb_set_intfdata(). When the device is later
> disconnected, snd_usb_caiaq_disconnect() calls
> snd_card_free_when_closed() on that same pointer, producing a
> double-free and slab corruption.
> 
> Add the missing return so a failed snd_card_register() cleanly
> aborts setup without touching freed memory.
> 
> The issue is reachable by any caiaq-compatible USB device whose
> descriptors cause snd_card_register() to fail. It was reproduced
> with raw-gadget + dummy_hcd on 7.0.0-rc5 (arm64, KASAN).
> 
> Fixes: 8e3cd08ed8e5 ("[ALSA] caiaq - add control API and more input features")
> Cc: stable@xxxxxxxxxxxxxxx
> Cc: Andrey Konovalov <andreyknvl@xxxxxxxxx>
> Signed-off-by: Berk Cem Goksel <berkcgoksel@xxxxxxxxx>
> ---
> v2:
>  - Correct "Fixes:" tag
> 
>  sound/usb/caiaq/device.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
> index 3a71bab8a477..d52f3b9a2bac 100644
> --- a/sound/usb/caiaq/device.c
> +++ b/sound/usb/caiaq/device.c
> @@ -369,6 +369,7 @@ static void setup_card(struct snd_usb_caiaqdev *cdev)
>  	if (ret < 0) {
>  		dev_err(dev, "snd_card_register() returned %d\n", ret);
>  		snd_card_free(cdev->chip.card);
> +		return;
>  	}
>
>  	ret = snd_usb_caiaq_control_init(cdev);

Looking at the code again, this fix doesn't seem sufficing.
And, we have snd_card_free() call in the error case of init_card(),
but setup_card() doesn't give the error back properly.

That said, a proper fix would be to change setup_card() to return the
error, and handle it in init_card().  The place you fixed should
return an error instead of calling snd_card_free() there.

I'm going to cook up a patch.


thanks,

Takashi