Takashi Iwai c95072b3d8 ALSA: line6: Fix leftover URB at error-path during probe ... While line6_probe() may kick off URB for a control MIDI endpoint, the function doesn't clean up it properly at its error path. This results in a leftover URB action that is eventually triggered later and causes an Oops like: general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 0 Comm: swapper/1 Not tainted RIP: 0010:usb_fill_bulk_urb ./include/linux/usb.h:1619 RIP: 0010:line6_start_listen+0x3fe/0x9e0 sound/usb/line6/driver.c:76 Call Trace: <IRQ> line6_data_received+0x1f7/0x470 sound/usb/line6/driver.c:326 __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779 usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845 dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965 call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281 .... Since the whole clean-up procedure is done in line6_disconnect() callback, we can simply call it in the error path instead of open-coding the whole again. It'll fix such an issue automagically. The bug was spotted by syzkaller. Fixes: eedd0e95d3 ("ALSA: line6: Don't forget to call driver's destructor at error path") Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>		2017-10-09 16:17:18 +02:00
..
capture.c
capture.h
driver.c	ALSA: line6: Fix leftover URB at error-path during probe	2017-10-09 16:17:18 +02:00
driver.h	ALSA: line6: remove unnecessary initialization to PODHD500X	2017-06-20 07:51:22 +02:00
Kconfig
Makefile
midi.c
midi.h
midibuf.c
midibuf.h
pcm.c	ALSA: usb-line6: constify snd_kcontrol_new strucutre array	2017-04-14 08:57:56 +02:00
pcm.h
playback.c
playback.h
pod.c
podhd.c	ALSA: line6: Fix NULL dereference at podhd_disconnect()	2017-10-09 16:17:09 +02:00
toneport.c
variax.c