Re: [PATCH] ALSA: jack: Pin the module while debugfs files are open

[Takashi Iwai]

On Mon, 19 Oct 2026 12:30:54 +0200,
Cen Zhang wrote:
> 
> With CONFIG_SND=m and CONFIG_SND_JACK_INJECTION_DEBUG enabled, an in-tree
> HDA jack creates these debugfs files through snd_jack_new() and
> snd_jack_add_debugfs(). Their file_operations live in snd, but none sets
> .owner. full_proxy_open_regular() therefore takes no snd module reference
> when it calls fops_get(real_fops).
> 
> A debugfs descriptor can outlive removal of its HDA card. Once the card
> and dependent modules, including the OSS emulation modules, have been
> removed, snd can be unloaded while that descriptor is still open:
> 
>   Descriptor holder                   Card/module teardown
>   -----------------                   --------------------
>   open jack debugfs file
>     full_proxy_open_regular()
>       fops_get(real_fops)
>         owner == NULL: no snd pin
>   keep descriptor open
>                                       remove HDA card
>                                         snd_card_disconnect()
>                                           snd_jack_dev_disconnect()
>                                           remove debugfs nodes
>                                         snd_jack_dev_free()
>                                       unload dependent modules
>                                       rmmod snd
>                                         alsa_sound_exit()
>                                         free_module(): unmap snd
>   close descriptor
>     full_proxy_release()
>       read real_fops->release
>       fops_put(real_fops)
>         read real_fops->owner
> 
> debugfs_remove() drains active operations, but does not wait for idle
> open descriptors. Release deliberately bypasses removal protection and
> reads the real table even when no release callback is installed. The
> last close can therefore access unloaded snd storage.
> 
> Set .owner to THIS_MODULE in all six tables. The existing proxy
> fops_get()/fops_put() pair then keeps snd loaded through the final table
> access on close.
> 
> Fixes: 2d670ea2bd53 ("ALSA: jack: implement software jack injection via debugfs")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>

Applied now.  Thanks.


Takashi