From: Bob Song <songxiebing@kylinos.cn>

Fix use-after-free bug in snd_pcm_oss_poll() caused by
io_uring asynchronous poll operations accessing already-freed
pcm_oss_file private data.

The bug happens because file->private_data still points to
kfree()'d memory after snd_pcm_oss_release(), and io_uring
may invoke ->poll() handler later.

Fix by:
1. Clearing file->private_data early in release function
2. Adding NULL check in release to avoid invalid access
3. Adding NULL check in poll handler to prevent UAF

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") /* pcm_oss initial */
Reported-by: syzbot+ee73befabe68e7907adf@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/alsa-devel/000000000000f1068105f20e5e8f@google.com/
Signed-off-by: Bob Song <songxiebing@kylinos.cn>
---
 sound/core/oss/pcm_oss.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index a140a0d9abb8..f3cebfaaa7dc 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2574,6 +2574,14 @@ static int snd_pcm_oss_release(struct inode *inode, struct file *file)
 	struct snd_pcm_oss_file *pcm_oss_file;
 
 	pcm_oss_file = file->private_data;
+
+	/* Prevent double-release and NULL dereference */
+	if (!pcm_oss_file)
+		return 0;
+
+	/* Clear private data to avoid UAF from async poll */
+	file->private_data = NULL;
+
 	substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
 	if (substream == NULL)
 		substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
@@ -2840,6 +2848,10 @@ static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait)
 	
 	pcm_oss_file = file->private_data;
 
+	/* Check for already released file to avoid UAF */
+	if (!pcm_oss_file)
+		return EPOLLERR | EPOLLHUP;
+
 	psubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
 	csubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
 
-- 
2.25.1

On Thu, 30 Apr 2026 04:14:01 +0200,
songxiebing wrote:
> 
> From: Bob Song <songxiebing@kylinos.cn>
> 
> Fix use-after-free bug in snd_pcm_oss_poll() caused by
> io_uring asynchronous poll operations accessing already-freed
> pcm_oss_file private data.
> 
> The bug happens because file->private_data still points to
> kfree()'d memory after snd_pcm_oss_release(), and io_uring
> may invoke ->poll() handler later.
> 
> Fix by:
> 1. Clearing file->private_data early in release function
> 2. Adding NULL check in release to avoid invalid access
> 3. Adding NULL check in poll handler to prevent UAF
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") /* pcm_oss initial */
> Reported-by: syzbot+ee73befabe68e7907adf@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/alsa-devel/000000000000f1068105f20e5e8f@google.com/

This is a very old report.  Are you sure that it's still valid with
the latest kernel?
I believe this kind of bug should have been already fixed.
(And above all, the suggested code change doesn't look enough as a
proper fix.)

The same question applied for your other two patches for rawmidi and
PCM UAFs.


thanks,

Takashi