Re: [linux-next:master 7970/9778] sound/usb/6fire/chip.c:154 usb6fire_chip_probe() warn: variable dereferenced before check 'card' (see line 123)

On Wed, 29 Jul 2026 07:43:10 +0200,
Dan Carpenter wrote:
> 
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
> head:   3652b49adac266a3d27cb41cdfdb7d8790fc3633
> commit: a54bf16965f896415c3337bc4fbb40fb11941d99 [7970/9778] ALSA: 6fire: Fix UAF at error handling during probe
> config: i386-randconfig-141-20260729 (https://download.01.org/0day-ci/archive/20260729/[email protected]/config)
> compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
> smatch: v0.5.0-9187-g5189e3fb
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <[email protected]>
> | Reported-by: Dan Carpenter <[email protected]>
> | Closes: https://lore.kernel.org/r/[email protected]/
> 
> smatch warnings:
> sound/usb/6fire/chip.c:154 usb6fire_chip_probe() warn: variable dereferenced before check 'card' (see line 123)
> 
> vim +/card +154 sound/usb/6fire/chip.c
> 
> 87f9796a0336ef Bill Pemberton 2012-12-06   70  static int usb6fire_chip_probe(struct usb_interface *intf,
> c6d43ba816d1cf Torsten Schenk 2011-01-24   71  			       const struct usb_device_id *usb_id)
> c6d43ba816d1cf Torsten Schenk 2011-01-24   72  {
> c6d43ba816d1cf Torsten Schenk 2011-01-24   73  	int ret;
> c6d43ba816d1cf Torsten Schenk 2011-01-24   74  	int i;
> c6d43ba816d1cf Torsten Schenk 2011-01-24   75  	struct sfire_chip *chip = NULL;
> c6d43ba816d1cf Torsten Schenk 2011-01-24   76  	struct usb_device *device = interface_to_usbdev(intf);
> c6d43ba816d1cf Torsten Schenk 2011-01-24   77  	int regidx = -1; /* index in module parameter array */
> c6d43ba816d1cf Torsten Schenk 2011-01-24   78  	struct snd_card *card = NULL;
> c6d43ba816d1cf Torsten Schenk 2011-01-24   79  
> c6d43ba816d1cf Torsten Schenk 2011-01-24   80  	/* look if we already serve this card and return if so */
> f3c80e76a0e94c Takashi Iwai   2026-04-14   81  	guard(mutex)(&register_mutex);
> c6d43ba816d1cf Torsten Schenk 2011-01-24   82  	for (i = 0; i < SNDRV_CARDS; i++) {
> 4d5de85b6a9961 Takashi Iwai   2026-04-14   83  		if (chips[i] && chips[i]->dev == device) {
> c6d43ba816d1cf Torsten Schenk 2011-01-24   84  			chips[i]->intf_count++;
> c6d43ba816d1cf Torsten Schenk 2011-01-24   85  			usb_set_intfdata(intf, chips[i]);
> c6d43ba816d1cf Torsten Schenk 2011-01-24   86  			return 0;
> 4d5de85b6a9961 Takashi Iwai   2026-04-14   87  		} else if (!chips[i] && regidx < 0)
> c6d43ba816d1cf Torsten Schenk 2011-01-24   88  			regidx = i;
> c6d43ba816d1cf Torsten Schenk 2011-01-24   89  	}
> c6d43ba816d1cf Torsten Schenk 2011-01-24   90  	if (regidx < 0) {
> e3b3757b92a4df Takashi Iwai   2014-02-26   91  		dev_err(&intf->dev, "too many cards registered.\n");
> c6d43ba816d1cf Torsten Schenk 2011-01-24   92  		return -ENODEV;
> c6d43ba816d1cf Torsten Schenk 2011-01-24   93  	}
> c6d43ba816d1cf Torsten Schenk 2011-01-24   94  
> c6d43ba816d1cf Torsten Schenk 2011-01-24   95  	/* check, if firmware is present on device, upload it if not */
> c6d43ba816d1cf Torsten Schenk 2011-01-24   96  	ret = usb6fire_fw_init(intf);
> c6d43ba816d1cf Torsten Schenk 2011-01-24   97  	if (ret < 0)
> c6d43ba816d1cf Torsten Schenk 2011-01-24   98  		return ret;
> c6d43ba816d1cf Torsten Schenk 2011-01-24   99  	else if (ret == FW_NOT_READY) /* firmware update performed */
> c6d43ba816d1cf Torsten Schenk 2011-01-24  100  		return 0;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  101  
> c6d43ba816d1cf Torsten Schenk 2011-01-24  102  	/* if we are here, card can be registered in alsa. */
> c6d43ba816d1cf Torsten Schenk 2011-01-24  103  	if (usb_set_interface(device, 0, 0) != 0) {
> e3b3757b92a4df Takashi Iwai   2014-02-26  104  		dev_err(&intf->dev, "can't set first interface.\n");
> c6d43ba816d1cf Torsten Schenk 2011-01-24  105  		return -EIO;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  106  	}
> 874b8d422e26e2 Takashi Iwai   2014-01-29  107  	ret = snd_card_new(&intf->dev, index[regidx], id[regidx],
> 874b8d422e26e2 Takashi Iwai   2014-01-29  108  			   THIS_MODULE, sizeof(struct sfire_chip), &card);
> c6d43ba816d1cf Torsten Schenk 2011-01-24  109  	if (ret < 0) {
> e3b3757b92a4df Takashi Iwai   2014-02-26  110  		dev_err(&intf->dev, "cannot create alsa card.\n");
> c6d43ba816d1cf Torsten Schenk 2011-01-24  111  		return ret;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  112  	}
> 19a28b8c7f9f63 Takashi Iwai   2025-07-10  113  	strscpy(card->driver, "6FireUSB");
> 19a28b8c7f9f63 Takashi Iwai   2025-07-10  114  	strscpy(card->shortname, "TerraTec DMX6FireUSB");
> c6d43ba816d1cf Torsten Schenk 2011-01-24  115  	sprintf(card->longname, "%s at %d:%d", card->shortname,
> c6d43ba816d1cf Torsten Schenk 2011-01-24  116  			device->bus->busnum, device->devnum);
> c6d43ba816d1cf Torsten Schenk 2011-01-24  117  
> c6d43ba816d1cf Torsten Schenk 2011-01-24  118  	chip = card->private_data;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  119  	chip->dev = device;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  120  	chip->regidx = regidx;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  121  	chip->intf_count = 1;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  122  	chip->card = card;
> a0810c3d6dd2d2 Takashi Iwai   2024-11-13 @123  	card->private_free = usb6fire_card_free;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  124  
> c6d43ba816d1cf Torsten Schenk 2011-01-24  125  	ret = usb6fire_comm_init(chip);
> f804fff1361c9d Markus Elfring 2017-09-06  126  	if (ret < 0)
> f804fff1361c9d Markus Elfring 2017-09-06  127  		goto destroy_chip;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  128  
> c6d43ba816d1cf Torsten Schenk 2011-01-24  129  	ret = usb6fire_midi_init(chip);
> f804fff1361c9d Markus Elfring 2017-09-06  130  	if (ret < 0)
> f804fff1361c9d Markus Elfring 2017-09-06  131  		goto destroy_chip;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  132  
> c6d43ba816d1cf Torsten Schenk 2011-01-24  133  	ret = usb6fire_pcm_init(chip);
> f804fff1361c9d Markus Elfring 2017-09-06  134  	if (ret < 0)
> f804fff1361c9d Markus Elfring 2017-09-06  135  		goto destroy_chip;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  136  
> c6d43ba816d1cf Torsten Schenk 2011-01-24  137  	ret = usb6fire_control_init(chip);
> f804fff1361c9d Markus Elfring 2017-09-06  138  	if (ret < 0)
> f804fff1361c9d Markus Elfring 2017-09-06  139  		goto destroy_chip;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  140  
> c6d43ba816d1cf Torsten Schenk 2011-01-24  141  	ret = snd_card_register(card);
> c6d43ba816d1cf Torsten Schenk 2011-01-24  142  	if (ret < 0) {
> e3b3757b92a4df Takashi Iwai   2014-02-26  143  		dev_err(&intf->dev, "cannot register card.");
> f804fff1361c9d Markus Elfring 2017-09-06  144  		goto destroy_chip;
> c6d43ba816d1cf Torsten Schenk 2011-01-24  145  	}
> 4d5de85b6a9961 Takashi Iwai   2026-04-14  146  
> c6d43ba816d1cf Torsten Schenk 2011-01-24  147  	usb_set_intfdata(intf, chip);
> 4d5de85b6a9961 Takashi Iwai   2026-04-14  148  	chips[regidx] = chip;
> 4d5de85b6a9961 Takashi Iwai   2026-04-14  149  
> c6d43ba816d1cf Torsten Schenk 2011-01-24  150  	return 0;
> f804fff1361c9d Markus Elfring 2017-09-06  151  
> f804fff1361c9d Markus Elfring 2017-09-06  152  destroy_chip:
> a54bf16965f896 Takashi Iwai   2026-07-26  153  	chip->shutdown = true;
> a54bf16965f896 Takashi Iwai   2026-07-26 @154  	if (card)
> 
> You could delete this check if you want.

Yes, the NULL check is superfluous and can be dropped.


> a54bf16965f896 Takashi Iwai   2026-07-26  155  		snd_card_disconnect(card);
> 
> Setting chip->shutdown = true means that it's pointless to
> call snd_card_disconnect().  It's a no-op.  snd_card_disconnect()
> has a "card->shutdown = 1;"

No, the above is chip->shutdown and it's different from
card->shutdown.


thanks,

Takashi