Re: [PATCH v2] ALSA: seq: midi: Serialize output teardown with event_input

[Takashi Iwai]

On Wed, 27 May 2026 08:29:48 +0200,
Zhang Cen wrote:
> 
> event_process_midi() borrows msynth->output_rfile.output and then
> passes the substream to dump_midi() and snd_rawmidi_kernel_write()
> without synchronizing with the output open/close transition.
> midisynth_use() also publishes output_rfile before
> snd_rawmidi_output_params() has finished.
> 
> The last midisynth_unuse() can therefore release the same rawmidi file
> and free substream->runtime before snd_rawmidi_kernel_write1() takes
> its runtime buffer reference. That leaves the event_input path using a
> stale substream or runtime and can end in a NULL-deref or use-after-free.
> 
> Fix this with two pieces of synchronization. Keep a short IRQ-safe
> spinlock only for publishing or clearing output_rfile and for pairing
> the output snapshot with an snd_use_lock_t reference. Once
> event_process_midi() has taken that in-flight reference, it drops the
> spinlock before calling snd_seq_dump_var_event(), dump_midi(), or
> snd_rawmidi_kernel_write(). midisynth_unuse() now detaches the visible
> rawmidi file under the same spinlock, waits for the in-flight writers
> to drain, and only then drains and releases the saved file.
> midisynth_use() likewise opens into a local snd_rawmidi_file and
> publishes it only after snd_rawmidi_output_params() succeeds.
> 
> The buggy scenario involves two paths, with each column showing the
> order within that path:
> 
> event_input path:                     last unuse path:
> 1. event_process_midi() snapshots    1. midisynth_unuse() starts
>    output_rfile.output.                 tearing down output_rfile.
> 2. dump_midi() reaches               2. snd_rawmidi_kernel_release()
>    snd_rawmidi_kernel_write()           closes the output file.
>    before runtime is pinned.         3. close_substream() frees
> 3. The callback keeps using             substream->runtime.
>    the borrowed substream.
> 
> Validation reproduced this kernel report:
> KASAN null-ptr-deref in snd_rawmidi_kernel_write1+0x56/0x360
> RIP: 0033:0x7fde7dd0837f
> RIP: 0010:snd_rawmidi_kernel_write1+0x56/0x360
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Zhang Cen <rollkingzzc@xxxxxxxxx>

Applied to for-next branch now.  Thanks.


Takashi