Re: [PATCH] ALSA: timer: Pin the module for userspace timer controllers

[Takashi Iwai]

On Sun, 11 Oct 2026 18:02:50 +0200,
Cen Zhang wrote:
> 
> The static snd_utimer_ids IDA must remain live until a userspace timer
> controller has returned its ID. However, snd_utimer_fops has no owner,
> so anon_inode_getfd() does not take a reference to snd-timer for the
> controller file.
> 
> With CONFIG_SND_TIMER=m and CONFIG_SND_UTIMER=y, userspace can create a
> controller with SNDRV_TIMER_IOCTL_CREATE and close the native timer
> file. If no timer instances or dependent modules retain snd-timer,
> ordinary module unload can then overlap the controller's final release:
> 
>   Controller final release              Module unload
>   snd_utimer_release()
>     snd_utimer_free()
>       snd_timer_free(): unlink provider
>       snd_utimer_put_id()
>         enter ida_free()
>                                         delete_module()
>                                           alsa_timer_exit()
>                                           free_module(): free MOD_DATA
>         access snd_utimer_ids.xa
> 
> The provider is already absent from snd_timer_free_all() when unload
> runs. Neither register_mutex nor the IDA's lock keeps module storage
> resident through the remaining IDA access. That access can therefore
> use freed module data and fault while acquiring the XArray lock, as
> shown in the Oops below.
> 
> Set snd_utimer_fops.owner to THIS_MODULE so anonymous-file creation
> takes the existing module reference. The VFS drops it only after
> snd_utimer_release() returns, keeping the IDA resident through
> ida_free() and preventing ordinary unload during that interval.
> 
> Oops report as below:
> 
>     BUG: unable to handle page fault for address: fffffbfff80480af
>     #PF: supervisor read access in kernel mode
>     #PF: error_code(0x0000) - not-present page
>     PGD 1a7ff6067 P4D 1a7ff6067 PUD 1a7ff2067 PMD 100ad6067 PTE 0
>     Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>     CPU: 0 UID: 0 PID: 485 Comm: alsa-utimer-fix Tainted: G           O        7.2.0-rc6-pmb-bt-functional-v1+ #1 PREEMPT(lazy)
>     Tainted: [O]=OOT_MODULE
>     Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
>     RIP: 0010:kasan_byte_accessible+0x15/0x30
>     Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 69 f1 2b ff 66 66 2e 0f 1f 84 00 00 00
>     RSP: 0018:ffff88811a457c48 EFLAGS: 00010086
>     RAX: dffffc0000000000 RBX: ffffffffc0240578 RCX: 0000000000000000
>     RDX: 0000000000000000 RSI: ffffffff861f111c RDI: fffffbfff80480af
>     RBP: ffffffffc0240578 R08: 0000000000000001 R09: 0000000000000000
>     R10: ffffffff891cc057 R11: ffff88811531ba00 R12: ffffffff861f111c
>     R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
>     FS:  00007ff190ff7780(0000) GS:ffff8881fda2a000(0000) knlGS:0000000000000000
>     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>     CR2: fffffbfff80480af CR3: 0000000116890003 CR4: 0000000000770ef0
>     PKRU: 55555554
>     Call Trace:
>      <TASK>
>      __kasan_check_byte+0x13/0x50
>      lock_acquire+0x113/0x2f0
>      ? __pfx_pmbd_probe_hit_cookie+0x10/0x10
>      ? lock_release+0xc8/0x280
>      ? srso_alias_return_thunk+0x5/0xfbef5
>      _raw_spin_lock_irqsave+0x3c/0x60
>      ? ida_free+0xd4/0x2b0
>      ida_free+0xd4/0x2b0
>      ? __pfx_ida_free+0x10/0x10
>      ? srso_alias_return_thunk+0x5/0xfbef5
>      ? __pfx_locks_remove_file+0x10/0x10
>      ? __fput+0x39f/0xa60
>      ? fput_close_sync+0xff/0x200
>      ? __pfx_fput_close_sync+0x10/0x10
>      ? dnotify_flush+0x22/0x4b0
>      ? __x64_sys_close+0x8c/0xf0
>      ? do_syscall_64+0x115/0x6a0
>      ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
>      </TASK>
>     Modules linked in: snd(O) [last unloaded: snd_timer(O)]
>     CR2: fffffbfff80480af
>     ---[ end trace 0000000000000000 ]---
> 
> Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>

Applied now to for-next branch.  Thanks.


Takashi