[PATCH] ALSA: pcm_oss: Fix use-after-free in poll via io_uring

[songxiebing]

From: Bob Song <songxiebing@xxxxxxxxxx>

Fix use-after-free bug in snd_pcm_oss_poll() caused by
io_uring asynchronous poll operations accessing already-freed
pcm_oss_file private data.

The bug happens because file->private_data still points to
kfree()'d memory after snd_pcm_oss_release(), and io_uring
may invoke ->poll() handler later.

Fix by:
1. Clearing file->private_data early in release function
2. Adding NULL check in release to avoid invalid access
3. Adding NULL check in poll handler to prevent UAF

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") /* pcm_oss initial */
Reported-by: syzbot+ee73befabe68e7907adf@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://lore.kernel.org/alsa-devel/000000000000f1068105f20e5e8f@xxxxxxxxxx/
Signed-off-by: Bob Song <songxiebing@xxxxxxxxxx>
---
 sound/core/oss/pcm_oss.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index a140a0d9abb8..f3cebfaaa7dc 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2574,6 +2574,14 @@ static int snd_pcm_oss_release(struct inode *inode, struct file *file)
 	struct snd_pcm_oss_file *pcm_oss_file;
 
 	pcm_oss_file = file->private_data;
+
+	/* Prevent double-release and NULL dereference */
+	if (!pcm_oss_file)
+		return 0;
+
+	/* Clear private data to avoid UAF from async poll */
+	file->private_data = NULL;
+
 	substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
 	if (substream == NULL)
 		substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
@@ -2840,6 +2848,10 @@ static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait)
 	
 	pcm_oss_file = file->private_data;
 
+	/* Check for already released file to avoid UAF */
+	if (!pcm_oss_file)
+		return EPOLLERR | EPOLLHUP;
+
 	psubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
 	csubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
 
-- 
2.25.1