@@ -788,17 +788,17 @@ int line6_probe(struct usb_interface *interface,
line6_get_usb_properties(line6);
+ /* initialize device data based on device: */
+ ret = private_init(line6, id);
+ if (ret < 0)
+ goto error;
+
if (properties->capabilities & LINE6_CAP_CONTROL) {
ret = line6_init_cap_control(line6);
if (ret < 0)
goto error;
}
- /* initialize device data based on device: */
- ret = private_init(line6, id);
- if (ret < 0)
- goto error;
-
/* creation of additional special files should go here */
dev_info(&interface->dev, "Line 6 %s now attached\n",
syzbot reported general protection fault in midibuf_is_full. the cause is linemidi pointer in struct usb_line6 isn't properly initialized. the pointer isn't initialized because there is race condition in line6_probe. it calls line6_init_cap_control first, which submits urb. and then it initializes it's data using private_init function. so it's possible line6_data_received is called before it's data isn't initialized. Link: https://lkml.org/lkml/2021/5/17/543 Reported-by: syzbot+0d2b3feb0a2887862e06@syzkallerlkml..appspotmail.com Signed-off-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> --- sound/usb/line6/driver.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)