linux-kernel - Re: [PATCH] ALSA: wavefront: Fix use-after-free in MIDI operations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87qzuchnxb.wl-tiwai@suse.de>
Date: Wed, 05 Nov 2025 09:41:04 +0100
From: Takashi Iwai <tiwai@...e.de>
To: moonafterrain@...look.com
Cc: Jaroslav Kysela <perex@...ex.cz>,
	Takashi Iwai <tiwai@...e.com>,
	linux-sound@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	stable@...r.kernel.org,
	Yuhao Jiang <danisjiang@...il.com>
Subject: Re: [PATCH] ALSA: wavefront: Fix use-after-free in MIDI operations

On Tue, 04 Nov 2025 15:11:55 +0100,
moonafterrain@...look.com wrote:
> 
> From: Junrui Luo <moonafterrain@...look.com>
> 
> Clear substream pointers in close functions to prevent use-after-free
> when timer callbacks or interrupt handlers access them after close.

There can be no actual access done because MPU401_MODE_INPUT_TRIGGER
is guaranteed to be off before closing the stream.  That is, the
variable stream is assigned to an old pointer, but it's not accessed.
So, this is not really a use-after-free bug, per se.

Other than that, the fix itself looks good.  Please resubmit after
rephrasing the patch description.


thanks,

Takashi


> Reported-by: Yuhao Jiang <danisjiang@...il.com>
> Reported-by: Junrui Luo <moonafterrain@...look.com>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@...r.kernel.org
> Signed-off-by: Junrui Luo <moonafterrain@...look.com>
> ---
>  sound/isa/wavefront/wavefront_midi.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/sound/isa/wavefront/wavefront_midi.c b/sound/isa/wavefront/wavefront_midi.c
> index 1250ecba659a..69d87c4cafae 100644
> --- a/sound/isa/wavefront/wavefront_midi.c
> +++ b/sound/isa/wavefront/wavefront_midi.c
> @@ -278,6 +278,7 @@ static int snd_wavefront_midi_input_close(struct snd_rawmidi_substream *substrea
>  	        return -EIO;
>  
>  	guard(spinlock_irqsave)(&midi->open);
> +	midi->substream_input[mpu] = NULL;
>  	midi->mode[mpu] &= ~MPU401_MODE_INPUT;
>  
>  	return 0;
> @@ -300,6 +301,7 @@ static int snd_wavefront_midi_output_close(struct snd_rawmidi_substream *substre
>  	        return -EIO;
>  
>  	guard(spinlock_irqsave)(&midi->open);
> +	midi->substream_output[mpu] = NULL;
>  	midi->mode[mpu] &= ~MPU401_MODE_OUTPUT;
>  	return 0;
>  }
> -- 
> 2.51.1.dirty
>