Re: [PATCH] ALSA: pcmtest: Pin the module while pattern files are open

[Takashi Iwai]

On Mon, 19 Oct 2026 11:04:42 +0200,
Cen Zhang wrote:
> 
> The fill_pattern_fops table must remain alive until the final release
> of each pattern debugfs file. It has no .owner, so the fops_get() call
> in full_proxy_open_regular() does not take a PCMTest module reference.
> 
> With snd-pcmtest loaded as a module, a user with permission to open a
> fill_patternN file and unload the module can retain the descriptor
> across normal unload, provided no PCM file or other module reference
> prevents it. The following ordering is possible:
> 
>   Pattern file user                   Module unload
>   -----------------                   -------------
>   open(fill_patternN)
>     full_proxy_open_regular()
>       fops_get(fill_pattern_fops)
>         owner == NULL: no module pin
>   keep the descriptor open
>                                       mod_exit()
>                                         clear_debug_files()
>                                           debugfs_remove_recursive()
>                                           drain active operations
>                                       return from mod_exit()
>                                       free_module()
>                                         free the module image
>   close(fd)
>     full_proxy_release()
>       read real_fops->release -> UAF
>       fops_put(real_fops)
>         read real_fops->owner
>       access freed module memory
> 
> Even though the table has no release callback, reading those fields
> is a use-after-free and can fault. The retained dentry keeps the
> proxy's bookkeeping alive, but does not retain the module storage.
> 
> Set .owner to THIS_MODULE so the existing fops_get()/fops_put() pair
> pins PCMTest until final release has finished accessing the table.
> Normal module unload is then blocked while any pattern file is open.
> 
> Fixes: 315a3d57c64c ("ALSA: Implement the new Virtual PCM Test Driver")
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>
> Assisted-by: LLM

Applied now.  Thanks.


Takashi