Re: [PATCH] ALSA: seq: fix use-after-free of borrowed substream in snd-seq-midi

[Doruk Tan Ozturk]

On Wed, 11 Jun 2026, Takashi Iwai wrote:
> There has been already a similar fix queued in sound.git tree for-next
> branch:
> ef7607ab1c8adc6258fb1b27d08e26aecdc18a58
>     ALSA: seq: midi: Serialize output teardown with event_input
>
> I believe this already addressed the bug.
>
> Let me know if there is still anything missing.

Hi Takashi,

Thanks for checking, and you're right -- ef7607ab1c8a ("ALSA: seq: midi:
Serialize output teardown with event_input") addresses the same race my
patch targeted: event_process_midi() borrowing msynth->output_rfile.output
while a concurrent midisynth_unuse() releases the rawmidi file and frees
substream->runtime before snd_rawmidi_kernel_write1() pins the runtime
buffer. That commit serializes the output_rfile publish/clear and pairs the
output snapshot with an in-flight reference, which closes the window, so my
patch is redundant.

Please drop mine; nothing further needed. Thanks!

Doruk