Re: [PATCH v2] ALSA: aloop: Fix peer runtime UAF during format-change stop

[Takashi Iwai]

On Fri, 24 Apr 2026 14:48:41 +0200,
Cássio Gabriel wrote:
> 
> loopback_check_format() may stop the capture side when playback starts
> with parameters that no longer match a running capture stream. Commit
> 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved
> the peer lookup under cable->lock, but the actual snd_pcm_stop() still
> runs after dropping that lock.
> 
> A concurrent close can clear the capture entry from cable->streams[] and
> detach or free its runtime while the playback trigger path still holds a
> stale peer substream pointer.
> 
> Keep a per-cable count of in-flight peer stops before dropping
> cable->lock, and make free_cable() wait for those stops before
> detaching the runtime. This preserves the existing behavior while
> making the peer runtime lifetime explicit.
> 
> Reported-by: syzbot+8fa95c41eafbc9d2ff6f@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=8fa95c41eafbc9d2ff6f
> Fixes: 597603d615d2 ("ALSA: introduce the snd-aloop module for the PCM loopback")
> Cc: stable@xxxxxxxxxxxxxxx
> Suggested-by: Takashi Iwai <tiwai@xxxxxxxx>
> Signed-off-by: Cássio Gabriel <cassiogabrielcontato@xxxxxxxxx>

Applied now.  Thanks.


Takashi