From nobody Mon Jun 8 19:36:02 2026 Received: from mail-pf1-f194.google.com (mail-pf1-f194.google.com [209.85.210.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1FA21377ED2 for ; Wed, 27 May 2026 06:29:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.194 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779863396; cv=none; b=nmCGJNsHiP2sFCAFLnJx+L39LRIzYZOLCAPLmi3GTluT7F8CK+jOydzLpXyrTd2wobIvA5tCx7lU0pctO0BW4g/+fg+XX+iJ1uoMIN6zzouf7iNGAw6kzjAqJYNT/Jfv0hLSOkV6aKEOUzoXpOk5Xrh6nZcDmHqhBYk9GvSq6YE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779863396; c=relaxed/simple; bh=rzofBfo1GKzZPsVF1L9CG1k0p53/qJR94RGP8EWBfX4=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=KHOZ1UZQ/3hpn7e5w3wjURGSICkcJx8HkdrgwsKhMiT01gY+4qwwrfjVvp2d6Ac5ehVacUosrj3H5XFgDWldLnqyGBP9L3/tE6lMTa7kg9bP7oy1MTY+W9rRkkl+OVgPWu31oeaPipC39qg4niaL4auo1PTDdqQJj5NYq22stBU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=UInwuVg2; arc=none smtp.client-ip=209.85.210.194 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UInwuVg2" Received: by mail-pf1-f194.google.com with SMTP id d2e1a72fcca58-837b39eb078so7867778b3a.2 for ; Tue, 26 May 2026 23:29:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779863394; x=1780468194; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=BJBe3vwF2QrPs3DYcUmdSptzLr4CaPZGGU2RkazVWwQ=; b=UInwuVg2m4E0qGy6qfc6PRMXQOnz4RQum2ffbmHJSjPSXkhOOxROi6MGAAt1Wxc3IG A/golsqEKbjaijJ69ariph5Dbhwui5XihAjNmi5jdClCBs40cYGaYJNPzZL3+xyTuDc0 402y/odnEKFy4DVMfuYOqC+eDzYHtgydnilfmkiPapKC88xsV+tgyyalGVpjtTG2Yq6H /eYUkpIlZ4rDeKcGI1GJW4pvGX4SVdyR4Mq6goNPYKxmTeAQsD7ObHjxBkRFxGm2jD8I 0058ErhICQ2whkmxi6JleW+FbXC9kkIwXN+sAvXN469Cqy4cP9gan6/Bsa6cem05PqMN JV9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779863394; x=1780468194; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=BJBe3vwF2QrPs3DYcUmdSptzLr4CaPZGGU2RkazVWwQ=; b=sNcipPH5QfNf45bo0n3gTm4GPaJeAl7ktrk0bRkmPxlKUL8qPq8lXPgDo4bU6NjlIP sCPLeY3V9SSc9LLg6v/5TMtvv4/KlL3cPbG8QFYAN5pev7MZENFsRPh/34oD7VwADsBz QZrFnGhmJugsqb8V1YTLyvvSfrFQoEfVuYjIE4IzxMtOE0HV5IEZg9CQKghh8H2IosBq 3bQwCfet6gQeS2O9M7IIE21DV47ZsSPDblhZVACvuhHBRxbZJ5sbrbnsHl0tZh8Xs1hP YQO+qOuSqSx5WRGyjG1mInz7PmjUk+pH74TNKRcw8rbQDFDModn1jeL3/BuuBln1D6Ar W90g== X-Forwarded-Encrypted: i=1; AFNElJ/D8WBcTHhsoDmz/twlgwxcjPVLsdGUqVNa+TqNurQL5eJtyphYEA3Uarv5snXNbunCbAFbCGlY0D8joac=@vger.kernel.org X-Gm-Message-State: AOJu0YwpD0R6KE0lSt6w83qO9BxnGe2QCVZsp7qJyKwyCOCB/W67zMYU M5sZgshDSTQlNbCtSpT6NUFAmjusVZglZj2iCm4vEyQCx/CV0NUx0goH X-Gm-Gg: Acq92OGwyTB1vrb/hqebuR9k61VLLytltWoEr+gjdiwNAWG0uG6V3T0HsyX2ivlh7P+ AA46KGdGDkudNvDQQobG4edvNnevPbGhNebfZ1QY5NFJ1Vywi1Okt9G/0Aon+AqkokRtCdh516G HLSRJkrxG7jMwBywWBpPZgUKXcemyGm/gsY0FGy1f/B/YnJ2VUQZ5KAo04ypHJgoDop4Wiat7xv 4x9UMvkAsT9FeRL7Z/drwRkYuMKl0Mb+A1YN167DwewtNbmzLr2GMWp6BfB83SqAw57BsVZWekY U8/Sxcwud7FkidZkQ0DiAuIuYMwuuDIkqNZ6bl+1FZ9RohnHeOzGb1sEtVp/KktgzmmEhsC0yCP 1mLtxIevClMAPYkdssnm9VqlQ8Nf6+KkbT187THtughJTJsjBfSHe1esu/RcE+D+quNKpwBLV4L vEhhfcxEbNObcCSUv7UlPmcA6qXCTyG1RpKum1PCChdA== X-Received: by 2002:a05:6a00:298f:b0:835:443e:4bc7 with SMTP id d2e1a72fcca58-8415f3fcafdmr19435866b3a.13.1779863394449; Tue, 26 May 2026 23:29:54 -0700 (PDT) Received: from localhost ([111.228.63.84]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-841d70bbf31sm1430399b3a.28.2026.05.26.23.29.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 May 2026 23:29:54 -0700 (PDT) From: Zhang Cen To: Jaroslav Kysela , Takashi Iwai Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org, zerocling0077@gmail.com, 2045gemini@gmail.com, Zhang Cen Subject: [PATCH v2] ALSA: seq: midi: Serialize output teardown with event_input Date: Wed, 27 May 2026 14:29:48 +0800 Message-Id: <20260527062948.3614025-1-rollkingzzc@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" event_process_midi() borrows msynth->output_rfile.output and then passes the substream to dump_midi() and snd_rawmidi_kernel_write() without synchronizing with the output open/close transition. midisynth_use() also publishes output_rfile before snd_rawmidi_output_params() has finished. The last midisynth_unuse() can therefore release the same rawmidi file and free substream->runtime before snd_rawmidi_kernel_write1() takes its runtime buffer reference. That leaves the event_input path using a stale substream or runtime and can end in a NULL-deref or use-after-free. Fix this with two pieces of synchronization. Keep a short IRQ-safe spinlock only for publishing or clearing output_rfile and for pairing the output snapshot with an snd_use_lock_t reference. Once event_process_midi() has taken that in-flight reference, it drops the spinlock before calling snd_seq_dump_var_event(), dump_midi(), or snd_rawmidi_kernel_write(). midisynth_unuse() now detaches the visible rawmidi file under the same spinlock, waits for the in-flight writers to drain, and only then drains and releases the saved file. midisynth_use() likewise opens into a local snd_rawmidi_file and publishes it only after snd_rawmidi_output_params() succeeds. The buggy scenario involves two paths, with each column showing the order within that path: event_input path: last unuse path: 1. event_process_midi() snapshots 1. midisynth_unuse() starts output_rfile.output. tearing down output_rfile. 2. dump_midi() reaches 2. snd_rawmidi_kernel_release() snd_rawmidi_kernel_write() closes the output file. before runtime is pinned. 3. close_substream() frees 3. The callback keeps using substream->runtime. the borrowed substream. Validation reproduced this kernel report: KASAN null-ptr-deref in snd_rawmidi_kernel_write1+0x56/0x360 RIP: 0033:0x7fde7dd0837f RIP: 0010:snd_rawmidi_kernel_write1+0x56/0x360 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: Codex:gpt-5.5 Signed-off-by: Zhang Cen --- v2: Use scoped_guard() for the short output_lock sections and drop the explicit irq flags variable, as suggested by Takashi Iwai. sound/core/seq/seq_midi.c | 55 +++++++++++++++++++++++++++++---------- 1 file changed, 41 insertions(+), 14 deletions(-) diff --git a/sound/core/seq/seq_midi.c b/sound/core/seq/seq_midi.c index ca3f5fc309927..2eb12199c92f9 100644 --- a/sound/core/seq/seq_midi.c +++ b/sound/core/seq/seq_midi.c @@ -24,6 +24,7 @@ Possible options for midisynth module: #include #include #include +#include "seq_lock.h" =20 MODULE_AUTHOR("Frank van de Pol , Jaroslav Kysela "); MODULE_DESCRIPTION("Advanced Linux Sound Architecture sequencer MIDI synth= ."); @@ -42,6 +43,8 @@ struct seq_midisynth { int device; int subdevice; struct snd_rawmidi_file input_rfile; + spinlock_t output_lock; /* protects output_rfile publication */ + snd_use_lock_t output_use_lock; /* in-flight event_input users */ struct snd_rawmidi_file output_rfile; int seq_client; int seq_port; @@ -125,31 +128,42 @@ static int event_process_midi(struct snd_seq_event *e= v, int direct, struct seq_midisynth *msynth =3D private_data; unsigned char msg[10]; /* buffer for constructing midi messages */ struct snd_rawmidi_substream *substream; + int err =3D 0; int len; =20 if (snd_BUG_ON(!msynth)) return -EINVAL; - substream =3D msynth->output_rfile.output; - if (substream =3D=3D NULL) - return -ENODEV; + + scoped_guard(spinlock_irqsave, &msynth->output_lock) { + substream =3D msynth->output_rfile.output; + if (!substream) + return -ENODEV; + snd_use_lock_use(&msynth->output_use_lock); + } + if (ev->type =3D=3D SNDRV_SEQ_EVENT_SYSEX) { /* special case, to save spa= ce */ if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) !=3D SNDRV_SEQ_EVENT_LENGT= H_VARIABLE) { /* invalid event */ pr_debug("ALSA: seq_midi: invalid sysex event flags =3D 0x%x\n", ev->fl= ags); - return 0; + goto out; } snd_seq_dump_var_event(ev, __dump_midi, substream); snd_midi_event_reset_decode(msynth->parser); } else { - if (msynth->parser =3D=3D NULL) - return -EIO; + if (!msynth->parser) { + err =3D -EIO; + goto out; + } len =3D snd_midi_event_decode(msynth->parser, msg, sizeof(msg), ev); if (len < 0) - return 0; + goto out; if (dump_midi(substream, msg, len) < 0) snd_midi_event_reset_decode(msynth->parser); } - return 0; + +out: + snd_use_lock_free(&msynth->output_use_lock); + return err; } =20 =20 @@ -163,6 +177,8 @@ static int snd_seq_midisynth_new(struct seq_midisynth *= msynth, msynth->card =3D card; msynth->device =3D device; msynth->subdevice =3D subdevice; + spin_lock_init(&msynth->output_lock); + snd_use_lock_init(&msynth->output_use_lock); return 0; } =20 @@ -215,12 +231,13 @@ static int midisynth_use(void *private_data, struct s= nd_seq_port_subscribe *info { int err; struct seq_midisynth *msynth =3D private_data; + struct snd_rawmidi_file rfile =3D {}; struct snd_rawmidi_params params; =20 /* open midi port */ err =3D snd_rawmidi_kernel_open(msynth->rmidi, msynth->subdevice, SNDRV_RAWMIDI_LFLG_OUTPUT, - &msynth->output_rfile); + &rfile); if (err < 0) { pr_debug("ALSA: seq_midi: midi output open failed!!!\n"); return err; @@ -229,12 +246,14 @@ static int midisynth_use(void *private_data, struct s= nd_seq_port_subscribe *info params.avail_min =3D 1; params.buffer_size =3D output_buffer_size; params.no_active_sensing =3D 1; - err =3D snd_rawmidi_output_params(msynth->output_rfile.output, ¶ms); + err =3D snd_rawmidi_output_params(rfile.output, ¶ms); if (err < 0) { - snd_rawmidi_kernel_release(&msynth->output_rfile); + snd_rawmidi_kernel_release(&rfile); return err; } snd_midi_event_reset_decode(msynth->parser); + scoped_guard(spinlock_irqsave, &msynth->output_lock) + msynth->output_rfile =3D rfile; return 0; } =20 @@ -242,11 +261,19 @@ static int midisynth_use(void *private_data, struct s= nd_seq_port_subscribe *info static int midisynth_unuse(void *private_data, struct snd_seq_port_subscri= be *info) { struct seq_midisynth *msynth =3D private_data; + struct snd_rawmidi_file rfile =3D {}; =20 - if (snd_BUG_ON(!msynth->output_rfile.output)) + scoped_guard(spinlock_irqsave, &msynth->output_lock) { + rfile =3D msynth->output_rfile; + msynth->output_rfile =3D (struct snd_rawmidi_file){}; + } + + if (snd_BUG_ON(!rfile.output)) return -EINVAL; - snd_rawmidi_drain_output(msynth->output_rfile.output); - return snd_rawmidi_kernel_release(&msynth->output_rfile); + + snd_use_lock_sync(&msynth->output_use_lock); + snd_rawmidi_drain_output(rfile.output); + return snd_rawmidi_kernel_release(&rfile); } =20 /* delete given midi synth port */ --=20 2.43.0