Re: [BUG] KASAN: slab-use-after-free in ALSA OSS read/poll race

[Jaeyoung Chung]

On Fri, Apr 24, 2026 at 5:28 PM Takashi Iwai <tiwai@xxxxxxx> wrote:
>
> Does something below work?
> Once after confirming, I'll submit a proper patch.
>
>
> thanks,
>
> Takashi
>
> -- 8< --
> diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
> --- a/sound/core/oss/pcm_oss.c
> +++ b/sound/core/oss/pcm_oss.c
> @@ -2155,10 +2155,16 @@ static int snd_pcm_oss_get_trigger(struct snd_pcm_oss_file *pcm_oss_file)
>
>         psubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
>         csubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
> -       if (psubstream && psubstream->runtime && psubstream->runtime->oss.trigger)
> -               result |= PCM_ENABLE_OUTPUT;
> -       if (csubstream && csubstream->runtime && csubstream->runtime->oss.trigger)
> -               result |= PCM_ENABLE_INPUT;
> +       if (psubstream && psubstream->runtime) {
> +               guard(mutex)(&psubstream->runtime->oss.params_lock);
> +               if (psubstream->runtime->oss.trigger)
> +                       result |= PCM_ENABLE_OUTPUT;
> +       }
> +       if (csubstream && csubstream->runtime) {
> +               guard(mutex)(&csubstream->runtime->oss.params_lock);
> +               if (csubstream->runtime->oss.trigger)
> +                       result |= PCM_ENABLE_INPUT;
> +       }
>         return result;
>  }
>
> @@ -2832,6 +2838,17 @@ static int snd_pcm_oss_capture_ready(struct snd_pcm_substream *substream)
>                                                 runtime->oss.period_frames;
>  }
>
> +static bool need_input_retrigger(struct snd_pcm_runtime *runtime)
> +{
> +       bool ret;
> +
> +       guard(mutex)(&runtime->oss.params_lock);
> +       ret = runtime->oss.trigger;
> +       if (ret)
> +               runtime->oss.trigger = 0;
> +       return ret;
> +}
> +
>  static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait)
>  {
>         struct snd_pcm_oss_file *pcm_oss_file;
> @@ -2864,11 +2881,11 @@ static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait)
>                             snd_pcm_oss_capture_ready(csubstream))
>                                 mask |= EPOLLIN | EPOLLRDNORM;
>                 }
> -               if (ostate != SNDRV_PCM_STATE_RUNNING && runtime->oss.trigger) {
> +               if (ostate != SNDRV_PCM_STATE_RUNNING &&
> +                   need_input_retrigger(runtime)) {
>                         struct snd_pcm_oss_file ofile;
>                         memset(&ofile, 0, sizeof(ofile));
>                         ofile.streams[SNDRV_PCM_STREAM_CAPTURE] = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
> -                       runtime->oss.trigger = 0;
>                         snd_pcm_oss_set_trigger(&ofile, PCM_ENABLE_INPUT);
>                 }
>         }
>
>

Thanks for the quick fix.

The patch looks good to me. I tested it on my side and no longer
see the KASAN report.