Re: [PATCH] ALSA: seq: fix use-after-free of borrowed substream in snd-seq-midi

[Takashi Iwai]

On Mon, 15 Jun 2026 02:28:21 +0200,
Doruk Tan Ozturk wrote:
> 
> On Wed, 11 Jun 2026, Takashi Iwai wrote:
> > There has been already a similar fix queued in sound.git tree for-next
> > branch:
> > ef7607ab1c8adc6258fb1b27d08e26aecdc18a58
> >     ALSA: seq: midi: Serialize output teardown with event_input
> >
> > I believe this already addressed the bug.
> >
> > Let me know if there is still anything missing.
> 
> Hi Takashi,
> 
> Thanks for checking, and you're right -- ef7607ab1c8a ("ALSA: seq: midi:
> Serialize output teardown with event_input") addresses the same race my
> patch targeted: event_process_midi() borrowing msynth->output_rfile.output
> while a concurrent midisynth_unuse() releases the rawmidi file and frees
> substream->runtime before snd_rawmidi_kernel_write1() pins the runtime
> buffer. That commit serializes the output_rfile publish/clear and pairs the
> output snapshot with an in-flight reference, which closes the window, so my
> patch is redundant.
> 
> Please drop mine; nothing further needed. Thanks!

Thanks for confirmation!


Takashi