Re: [PATCH] ALSA: seq: Serialize compat port-info ioctls

[Takashi Iwai]

On Thu, 17 Sep 2026 12:56:43 +0200,
Bruno Produit wrote:
> 
> From: Kyle Zeng <kylebot@xxxxxxxxxx>
> 
> The native sequencer ioctl path serializes handler calls with
> client->ioctl_mutex, but the translated port-info compat path invokes the
> same handlers through snd_seq_kernel_client_ctl() without taking that
> mutex.
> 
> This lets concurrent compat CREATE_PORT requests pass the port-count
> check before any request reaches the serialized insertion. The computed
> integer port index can then exceed the address field range and wrap to an
> existing index. Subsequent subscriber teardown can resolve the duplicate
> address to the wrong port and access a freed subscriber.
> 
> Take ioctl_mutex while dispatching converted port-info requests, matching
> the native ioctl path. All translated port-info commands share this
> helper, so their accesses to the client port state are serialized as
> well.
> 
> Fixes: b3defb791b26 ("ALSA: seq: Make ioctls race-free")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Codex:gpt-5.6-sol gpt-6-astra
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
> Signed-off-by: Bruno Produit <bruno.produit@xxxxxxxxxxxxxxx>
> ---
> 
> Trail of Bits has a reproducer for this bug that triggers a
> KASAN use-after-free and can it share if needed

The bug looks obvious, a long-standing oversight.
Applied now.


thanks,

Takashi