ALSA: caiaq: Handle probe errors properly
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: take a reference on the USB device in createcard()
The caiaq driver stores a pointer to the parent USB device in cdev->chip.dev but never takes a reference on it. The card's privatefree callback, sndusbcaiaqcardfree(), can run asynchronously via sndcardfreewhenclosed() after the USB device has already been disconnected and freed, so any access to cdev->chip.dev in that path dereferences a freed usbdevice.
On top of the refcounting issue, the current cardfree implementation calls usbresetdevice(cdev->chip.dev). A reset in a free callback is inappropriate: the device is going away, the call takes the device lock in a teardown context, and the reset races with the disconnect path that the callback is already cleaning up after.
Take a reference on the USB device in createcard() with usbgetdev(), drop it with usbputdev() in the free callback, and remove the usbresetdevice() call.