syzbot reported general protection fault in midibuf_is_full. the cause is linemidi pointer in struct usb_line6 isn't properly initialized. the pointer isn't initialized because there is race condition in line6_probe. it calls line6_init_cap_control first, which submits urb. and then it initializes it's data using private_init function. so it's possible line6_data_received is called before it's data isn't initialized. Link: https://lkml.org/lkml/2021/5/17/543 Reported-by: syzbot+0d2b3feb0a2887862e06@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Hyeonggon Yoo <42.hyeyoo@xxxxxxxxx> --- sound/usb/line6/driver.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index a030dd65eb28..2c183a2a30f0 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -788,17 +788,17 @@ int line6_probe(struct usb_interface *interface, line6_get_usb_properties(line6); + /* initialize device data based on device: */ + ret = private_init(line6, id); + if (ret < 0) + goto error; + if (properties->capabilities & LINE6_CAP_CONTROL) { ret = line6_init_cap_control(line6); if (ret < 0) goto error; } - /* initialize device data based on device: */ - ret = private_init(line6, id); - if (ret < 0) - goto error; - /* creation of additional special files should go here */ dev_info(&interface->dev, "Line 6 %s now attached\n", -- 2.25.1
