[PATCH] ALSA: pcm: Protect delay DMA sync against concurrent HW_FREE

[Cen Zhang]

A PCM DMA buffer must remain allocated until explicit DMA synchronization
finishes. snd_pcm_delay() calls snd_pcm_dma_buffer_sync() after dropping
the stream lock, without participating in the buffer-access exclusion
used by HW_FREE.

With a managed NONCONTIG buffer requiring explicit sync, HW_PARAMS can
allocate a separate runtime descriptor when the requested ring exceeds
the preallocation. In PREPARED state with mmap_count zero, concurrent
HWSYNC and HW_FREE calls on the same open PCM file can interleave:

1. HWSYNC checks the state in snd_pcm_delay() under the stream lock and
   releases that lock.
2. The sync helper fetches runtime->dma_buffer_p and enters
   snd_dma_noncontig_sync() with that descriptor.
3. HW_FREE takes the negative buffer-access count, checks PREPARED under
   the stream lock, releases the lock, and frees the DMA allocation and
   dynamic descriptor through snd_pcm_lib_free_pages().
4. The sync callback resumes and reads the freed descriptor.

The stream lock does not cover the allocation's release, and the sync
operation has no positive buffer-access count to prevent it. The stale
read causes a use-after-free in snd_dma_noncontig_sync(). DELAY uses the
same snd_pcm_delay() path.

Take a positive buffer-access count before checking the state and keep it
until the DMA sync finishes, as the transfer and mmap paths already do.
HW_FREE then returns -EBUSY while this access is active. If a buffer
writer has already entered, snd_pcm_delay() returns -EBUSY before using
the buffer. Keep the sync outside the stream lock and balance the count
on the state-error path as well.

KASAN report as below:

    BUG: KASAN: slab-use-after-free in snd_dma_noncontig_sync+0x295/0x310 [snd_pcm]
    Read of size 4 at addr ffff888108f58584 by task pcm-uaf-fixture/487

    CPU: 1 UID: 0 PID: 487 Comm: pcm-uaf-fixture Not tainted 7.2.0-rc6-pmb-alsa-functional-v2+ #1 PREEMPT(lazy)
    Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    Call Trace:
     <TASK>
     dump_stack_lvl+0x93/0xd0
     print_report+0xce/0x630
     ? snd_dma_noncontig_sync+0x295/0x310 [snd_pcm]
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __virt_addr_valid+0x20d/0x410
     ? snd_dma_noncontig_sync+0x295/0x310 [snd_pcm]
     kasan_report+0xe0/0x110
     ? snd_dma_noncontig_sync+0x295/0x310 [snd_pcm]
     ? __pfx_snd_dma_noncontig_sync+0x10/0x10 [snd_pcm]
     snd_dma_noncontig_sync+0x295/0x310 [snd_pcm]
     ? __pfx_snd_dma_noncontig_sync+0x10/0x10 [snd_pcm]
     snd_dma_buffer_sync+0xc9/0x110 [snd_pcm]
     snd_pcm_delay+0x3bd/0x550 [snd_pcm]
     snd_pcm_common_ioctl+0x1e7/0x3aa0 [snd_pcm]
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? do_vfs_ioctl+0x1f5/0x1280
     ? __pfx_do_vfs_ioctl+0x10/0x10
     ? ioctl_has_perm.constprop.0.isra.0+0x34f/0x500
     ? __pfx_snd_pcm_common_ioctl+0x10/0x10 [snd_pcm]
     ? srso_alias_return_thunk+0x5/0xfbef5
     snd_pcm_ioctl+0x76/0xb0 [snd_pcm]
     ? __pfx_snd_pcm_ioctl+0x10/0x10 [snd_pcm]
     __x64_sys_ioctl+0x163/0x1d0
     do_syscall_64+0x115/0x6a0
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7f1cae7ab91b
    Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
    RSP: 002b:00007ffe12d544f0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
    RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f1cae7ab91b
    RDX: 0000000000000000 RSI: 0000000000004122 RDI: 0000000000000003
    RBP: 00000000000001ee R08: 0000000000000073 R09: 00000000ffffffff
    R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
    R13: 0000000000000001 R14: 00005584f32b1398 R15: 00005584f32b2ce8
     </TASK>

    Allocated by task 487:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     __kasan_kmalloc+0xaa/0xb0
     __kmalloc_cache_noprof+0x251/0x610
     snd_pcm_lib_malloc_pages+0x27c/0x9f0 [snd_pcm]
     snd_pcm_hw_params+0x171c/0x1d10 [snd_pcm]
     snd_pcm_common_ioctl+0x1f62/0x3aa0 [snd_pcm]
     snd_pcm_ioctl+0x76/0xb0 [snd_pcm]
     __x64_sys_ioctl+0x163/0x1d0
     do_syscall_64+0x115/0x6a0
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    Freed by task 499:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     kasan_save_free_info+0x3b/0x60
     __kasan_slab_free+0x5f/0x80
     kfree+0x307/0x580
     snd_pcm_lib_free_pages+0x1c9/0x420 [snd_pcm]
     snd_pcm_common_ioctl+0x2bd3/0x3aa0 [snd_pcm]
     snd_pcm_ioctl+0x76/0xb0 [snd_pcm]
     __x64_sys_ioctl+0x163/0x1d0
     do_syscall_64+0x115/0x6a0
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    The buggy address belongs to the object at ffff888108f58580
     which belongs to the cache kmalloc-64 of size 64
    The buggy address is located 4 bytes inside of
     freed 64-byte region [ffff888108f58580, ffff888108f585c0)

    The buggy address belongs to the physical page:
    page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108f58
    flags: 0x200000000000000(node=0|zone=2)
    page_type: f5(slab)
    raw: 0200000000000000 ffff8881000428c0 dead000000000100 dead000000000122
    raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
    page dumped because: kasan: bad access detected

    Memory state around the buggy address:
     ffff888108f58480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
     ffff888108f58500: 00 00 00 00 00 06 fc fc fc fc fc fc fc fc fc fc
    >ffff888108f58580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                       ^
     ffff888108f58600: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
     ffff888108f58680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
    ==================================================================
    Disabling lock debugging due to kernel taint
    ------------[ cut here ]------------
    kernel BUG at kernel/dma/mapping.c:417!
    Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
    CPU: 1 UID: 0 PID: 487 Comm: pcm-uaf-fixture Tainted: G    B               7.2.0-rc6-pmb-alsa-functional-v2+ #1 PREEMPT(lazy)
    Tainted: [B]=BAD_PAGE
    Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    RIP: 0010:__dma_sync_sg_for_cpu+0x230/0x360
    Code: df 48 c1 e8 03 80 3c 10 00 0f 85 fa 00 00 00 4c 8b 35 d4 6b 7a 09 e8 7f e2 17 00 83 fd 02 0f 86 39 fe ff ff e8 71 e2 17 00 90 <0f> 0b e8 69 e2 17 00 be 08 00 00 00 4c 89 ff e8 bc 5f 77 00 4c 89
    RSP: 0018:ffff888111f3fc50 EFLAGS: 00010293
    RAX: 0000000000000000 RBX: ffffffffc0250d10 RCX: ffffffff816d395f
    RDX: ffff88810836ba00 RSI: ffff888108f58580 RDI: ffffffffc02510d8
    RBP: 00000000ffff8881 R08: 0000000000000000 R09: fffffbfff804a239
    R10: ffffffffc02511cf R11: 6e696c6261736944 R12: ffff888108f58580
    R13: 0000000002ce00e5 R14: ffffffffc0258720 R15: 0000000000000000
    FS:  00007f1cae69c780(0000) GS:ffff8881fd861000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000055d1affa2480 CR3: 0000000108fc0003 CR4: 0000000000770ef0
    PKRU: 55555554
    Call Trace:
     <TASK>
     snd_dma_noncontig_sync+0x15a/0x310 [snd_pcm]
     ? __pfx_snd_dma_noncontig_sync+0x10/0x10 [snd_pcm]
     snd_dma_buffer_sync+0xc9/0x110 [snd_pcm]
     snd_pcm_delay+0x3bd/0x550 [snd_pcm]
     snd_pcm_common_ioctl+0x1e7/0x3aa0 [snd_pcm]
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? do_vfs_ioctl+0x1f5/0x1280
     ? __pfx_do_vfs_ioctl+0x10/0x10
     ? ioctl_has_perm.constprop.0.isra.0+0x34f/0x500
     ? __pfx_snd_pcm_common_ioctl+0x10/0x10 [snd_pcm]
     ? srso_alias_return_thunk+0x5/0xfbef5
     snd_pcm_ioctl+0x76/0xb0 [snd_pcm]
     ? __pfx_snd_pcm_ioctl+0x10/0x10 [snd_pcm]
     __x64_sys_ioctl+0x163/0x1d0
     do_syscall_64+0x115/0x6a0
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7f1cae7ab91b
    Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
    RSP: 002b:00007ffe12d544f0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
    RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f1cae7ab91b
    RDX: 0000000000000000 RSI: 0000000000004122 RDI: 0000000000000003
    RBP: 00000000000001ee R08: 0000000000000073 R09: 00000000ffffffff
    R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
    R13: 0000000000000001 R14: 00005584f32b1398 R15: 00005584f32b2ce8
     </TASK>
    Modules linked in: snd_pcmtest snd_pcm
    ---[ end trace 0000000000000000 ]---
    RIP: 0010:__dma_sync_sg_for_cpu+0x230/0x360
    Code: df 48 c1 e8 03 80 3c 10 00 0f 85 fa 00 00 00 4c 8b 35 d4 6b 7a 09 e8 7f e2 17 00 83 fd 02 0f 86 39 fe ff ff e8 71 e2 17 00 90 <0f> 0b e8 69 e2 17 00 be 08 00 00 00 4c 89 ff e8 bc 5f 77 00 4c 89
    RSP: 0018:ffff888111f3fc50 EFLAGS: 00010293
    RAX: 0000000000000000 RBX: ffffffffc0250d10 RCX: ffffffff816d395f
    RDX: ffff88810836ba00 RSI: ffff888108f58580 RDI: ffffffffc02510d8
    RBP: 00000000ffff8881 R08: 0000000000000000 R09: fffffbfff804a239
    R10: ffffffffc02511cf R11: 6e696c6261736944 R12: ffff888108f58580
    R13: 0000000002ce00e5 R14: ffffffffc0258720 R15: 0000000000000000
    FS:  00007f1cae69c780(0000) GS:ffff8881fd861000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000055d1affa2480 CR3: 0000000108fc0003 CR4: 0000000000770ef0
    PKRU: 55555554
    Kernel panic - not syncing: Fatal exception
    Kernel Offset: disabled
    Rebooting in 1 seconds..

Fixes: a25684a95646 ("ALSA: memalloc: Support for non-contiguous page allocation")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>
---

diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index defbb2977efe9dcd8d48b934c3944d3fe159bcd6..f774358629bbc611bd15a1f8cbd4dda3ba7f45b6 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3116,14 +3116,19 @@ static snd_pcm_sframes_t snd_pcm_forward(struct snd_pcm_substream *substream,
 static int snd_pcm_delay(struct snd_pcm_substream *substream,
 			 snd_pcm_sframes_t *delay)
 {
+	struct snd_pcm_runtime *runtime = substream->runtime;
 	int err;
 
+	/* Keep the DMA buffer alive through the sync below. */
+	if (!atomic_inc_unless_negative(&runtime->buffer_accessing))
+		return -EBUSY;
 	scoped_guard(pcm_stream_lock_irq, substream) {
 		err = do_pcm_hwsync(substream);
 		if (delay && !err)
 			*delay = snd_pcm_calc_delay(substream);
 	}
 	snd_pcm_dma_buffer_sync(substream, SNDRV_DMA_SYNC_CPU);
+	atomic_dec(&runtime->buffer_accessing);
 
 	return err;
 }