syzbot reported general protection fault in midibuf_is_full. the cause is linemidi pointer in struct usb_line6 isn't properly initialized.
the pointer isn't initialized because there is race condition in line6_probe. it calls line6_init_cap_control first, which submits urb. and then it initializes it's data using private_init function.
so it's possible line6_data_received is called before it's data isn't initialized.
Link: https://lkml.org/lkml/2021/5/17/543 Reported-by: syzbot+0d2b3feb0a2887862e06@syzkallerlkml..appspotmail.com Signed-off-by: Hyeonggon Yoo 42.hyeyoo@gmail.com --- sound/usb/line6/driver.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index a030dd65eb28..2c183a2a30f0 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -788,17 +788,17 @@ int line6_probe(struct usb_interface *interface,
line6_get_usb_properties(line6);
+ /* initialize device data based on device: */ + ret = private_init(line6, id); + if (ret < 0) + goto error; + if (properties->capabilities & LINE6_CAP_CONTROL) { ret = line6_init_cap_control(line6); if (ret < 0) goto error; }
- /* initialize device data based on device: */ - ret = private_init(line6, id); - if (ret < 0) - goto error; - /* creation of additional special files should go here */
dev_info(&interface->dev, "Line 6 %s now attached\n",