Commit 9b1dbd69 authored by Mehul Rao's avatar Mehul Rao Committed by Takashi Iwai
Browse files

ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() 



In the drain loop, the local variable 'runtime' is reassigned to a
linked stream's runtime (runtime = s->runtime at line 2157).  After
releasing the stream lock at line 2169, the code accesses
runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size
(lines 2170-2178) — all referencing the linked stream's runtime without
any lock or refcount protecting its lifetime.

A concurrent close() on the linked stream's fd triggers
snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private()
→ snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime).
No synchronization prevents kfree(runtime) from completing while the
drain path dereferences the stale pointer.

Fix by caching the needed runtime fields (no_period_wakeup, rate,
buffer_size) into local variables while still holding the stream lock,
and using the cached values after the lock is released.

Fixes: f2b3614c ("ALSA: PCM - Don't check DMA time-out too shortly")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMehul Rao <mehulrao@gmail.com>
Link: https://patch.msgid.link/20260305193508.311096-1-mehulrao@gmail.com


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 56fbbe09

sound/core/pcm_native.c

+16 −3
Original line number Diff line number Diff line
@@ -2144,6 +2144,10 @@ static int snd_pcm_drain(struct snd_pcm_substream *substream, 
	for (;;) {

		long tout;

		struct snd_pcm_runtime *to_check;

		unsigned int drain_rate;

		snd_pcm_uframes_t drain_bufsz;

		bool drain_no_period_wakeup;



		if (signal_pending(current)) {

			result = -ERESTARTSYS;

			break;
@@ -2163,16 +2167,25 @@ static int snd_pcm_drain(struct snd_pcm_substream *substream, 
		snd_pcm_group_unref(group, substream);

		if (!to_check)

			break; /* all drained */

		/*

		 * Cache the runtime fields needed after unlock.

		 * A concurrent close() on the linked stream may free

		 * its runtime via snd_pcm_detach_substream() once we

		 * release the stream lock below.

		 */

		drain_no_period_wakeup = to_check->no_period_wakeup;

		drain_rate = to_check->rate;

		drain_bufsz = to_check->buffer_size;

		init_waitqueue_entry(&wait, current);

		set_current_state(TASK_INTERRUPTIBLE);

		add_wait_queue(&to_check->sleep, &wait);

		snd_pcm_stream_unlock_irq(substream);

		if (runtime->no_period_wakeup)

		if (drain_no_period_wakeup)

			tout = MAX_SCHEDULE_TIMEOUT;

		else {

			tout = 100;

			if (runtime->rate) {

				long t = runtime->buffer_size * 1100 / runtime->rate;

			if (drain_rate) {

				long t = drain_bufsz * 1100 / drain_rate;

				tout = max(t, tout);

			}

			tout = msecs_to_jiffies(tout);