Re: [BUG] KASAN: slab-use-after-free in ALSA OSS read/poll race

[Takashi Iwai <tiwai@suse.de>]

On Thu, 23 Apr 2026 16:53:30 +0200,
Jaeyoung Chung wrote:
> 
> Hello,
> 
> We found a KASAN slab-use-after-free in the ALSA OSS-compatibility
> layer (sound/core/oss/pcm_oss.c) on Linux v6.19.13. A concurrent
> read() and pselect() on an OSS audio device (/dev/dsp) corrupts the
> packed bit-flags in struct snd_pcm_oss_runtime and ends up freeing a
> buffer while another thread is still writing into it.
> 
> # Summary
> 
> struct snd_pcm_oss_runtime packs four flags into one storage word:
> 
>     /* include/sound/pcm_oss.h */
>     unsigned params: 1,			/* format/parameter change */
>       prepare: 1,			/* need to prepare the operation */
>       trigger: 1,			/* trigger flag */
>       sync_trigger: 1;		/* sync trigger flag */
> 
> Every writer of these flags holds runtime->oss.params_lock EXCEPT
> snd_pcm_oss_poll(), which clears runtime->oss.trigger unlocked. The
> resulting byte-level RMW race lets poll()'s stale store clobber the
> params=0 store done by snd_pcm_oss_change_params_locked(), so
> runtime->oss.params stays 1. The next snd_pcm_oss_make_ready() then
> re-enters change_params_locked() and runs snd_pcm_oss_plugin_clear()
> while a concurrent snd_pcm_oss_read3() is mid-transfer, freeing the
> plugin chain and buffer that __snd_pcm_lib_xfer() is copying into.
> 
> # Environment
> 
> - Kernel:  Linux v6.19.13
> - Arch:    x86_64
> - Relevant config:
>     CONFIG_SOUND=y
>     CONFIG_SND=y
>     CONFIG_SND_PCM=y
>     CONFIG_SND_OSSEMUL=y
>     CONFIG_SND_PCM_OSS=y
>     CONFIG_SND_PCM_OSS_PLUGINS=y
>     CONFIG_SND_ALOOP=y
>     CONFIG_KASAN=y
> - Device:  /dev/dsp backed by snd-aloop (ALSA loopback).
>            This is the only card I verified the crash on; with
>            CONFIG_SND_ALOOP=y and no other sound card, /proc/asound/cards
>            reports:
>              0 [Loopback       ]: Loopback - Loopback
>                                   Loopback 1
>            Whether other OSS-capable cards are affected has not been
>            tested.
> 
> # Thread interleaving
> 
> Shared byte B = params | prepare | trigger | sync_trigger.
> Initial: params=1, trigger=1  =>  B = 0b0101 = 0x05.
> 
>   CPU 0: read() thread                         CPU 1: pselect() thread
>   ====================                         =======================
>   snd_pcm_oss_read -> read1
>     mutex_lock(params_lock)
>     snd_pcm_oss_make_ready_locked
>       snd_pcm_oss_change_params_locked
>         plugin->buf = kvzalloc(size, GFP_KERNEL);
>                                                 snd_pcm_oss_poll
>                                                 // runtime->oss.trigger = 0;
>                                                  reg = READ(B)        ; reg = 0x05
>                                                  /* mdelay(100) */
>         // runtime->oss.params = 0;
>         RMW B: params  = 0  ; B := 0x04
> 	      // runtime->oss.prepare = 1;
>         RMW B: prepare = 1  ; B := 0x06
>     snd_pcm_oss_read2
>       snd_pcm_plug_read_transfer
>         snd_pcm_oss_read3
>           mutex_unlock(params_lock)
>           /* mdelay(1000) */
>                                                      reg &= ~0x4        ; reg = 0x01
>                                                      WRITE(B, reg)      ; B := 0x01
>                                                      /* clobbers A's (params=0,
>                                                         prepare=1): params is 1 again */
>                                                      snd_pcm_oss_set_trigger(.., PCM_ENABLE_INPUT)
>                                                        snd_pcm_oss_make_ready(csubstream)
>                                                          /* oss.params == 1 (stale) */
>                                                          snd_pcm_oss_change_params
>                                                            mutex_lock(params_lock)
>                                                            change_params_locked:
>                                                              snd_pcm_oss_plugin_clear
>                                                                kvfree(plugin->buf);
>                                                            mutex_unlock(params_lock)
>           __snd_pcm_lib_xfer
>             default_read_copy
>               copy_to_iter
>                 memcpy(<freed buffer>, ...)    <-- USE-AFTER-FREE (write)
> 
> # Included items
> 
> 1. C reproducer
> 2. Kernel delay patch (for deterministic triggering only; not the fix)
> 3. KASAN crash log
> 4. Proposed fix
> 
> -----------------------------------------------------------------------
> 1. C reproducer
> -----------------------------------------------------------------------
> Build: gcc -static -pthread -o race race.c
> Run:   ./race                  # uses /dev/dsp by default
> 
> // -- begin race.c --
> // gcc -static -o race race.c -lpthread
> #define _GNU_SOURCE
> #include <err.h>
> #include <fcntl.h>
> #include <pthread.h>
> #include <sched.h>
> #include <stdio.h>
> #include <string.h>
> #include <sys/select.h>
> #include <time.h>
> #include <unistd.h>
> 
> #define SYSCHK(x) \
>   ({ \
>     typeof(x) __res = (x); \
>     if (__res == (typeof(x))-1) \
>       err(1, "SYSCHK(" #x ")"); \
>     __res; \
>   })
> 
> #define DSP_PATH "/dev/dsp"
> int dsp_fd, ready = 0;
> 
> void pin_to_cpu(int cpu) {
>   cpu_set_t cset;
>   CPU_ZERO(&cset);
>   CPU_SET(cpu, &cset);
>   SYSCHK(sched_setaffinity(0, sizeof(cset), &cset));
> }
> 
> static void *poll_thread(void *arg) {
>   fd_set rfds;
>   struct timespec timeout = {.tv_sec = 30};
> 
>   pin_to_cpu(0);
>   FD_ZERO(&rfds);
>   FD_SET(dsp_fd, &rfds);
>   printf("[begin] pselect\n");
>   while (!ready) {
> 	sched_yield();
>   }
>   int ret = pselect(dsp_fd + 1, &rfds, NULL, NULL, &timeout, NULL);
>   printf("[end] pselect = %d\n", ret);
> 
>   return NULL;
> }
> 
> static void *read_thread(void *arg) {
>   unsigned char buf[1] = {0};
> 
>   pin_to_cpu(1);
>   printf("[begin] read\n");
>   ready = 1;
>   sched_yield();
>   ssize_t ret = read(dsp_fd, buf, sizeof(buf));
>   printf("[end] read = %zd\n", ret);
> 
>   return NULL;
> }
> 
> int main(int argc, char **argv) {
>   const char *path = (argc > 1) ? argv[1] : DSP_PATH;
>   pthread_t t1, t2;
> 
>   pin_to_cpu(0);
> 
>   dsp_fd = SYSCHK(open(path, O_RDONLY));
> 
>   pthread_create(&t1, NULL, poll_thread, NULL);
>   pthread_create(&t2, NULL, read_thread, NULL);
> 
>   pthread_join(t1, NULL);
>   pthread_join(t2, NULL);
> 
>   close(dsp_fd);
>   return 0;
> }
> // -- end race.c --
> 
> -----------------------------------------------------------------------
> 2. Kernel delay patch (to make the race deterministic)
> -----------------------------------------------------------------------
> This is NOT the fix. It only widens two windows:
>   (a) In snd_pcm_oss_poll(), split "trigger = 0" into an explicit
>       READ / mdelay(100) / MODIFY / WRITE on the underlying byte, to
>       emulate and stretch the compiler-emitted byte RMW.
>   (b) In snd_pcm_oss_read3(), insert mdelay(1000) between
>       mutex_unlock() and __snd_pcm_lib_xfer() so the plugin chain is
>       still in use while the racing free happens.
> 
> diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
> index 3bc94d34b..f7a176444 100644
> --- a/sound/core/oss/pcm_oss.c
> +++ b/sound/core/oss/pcm_oss.c
> @@ -29,6 +29,7 @@
>  #include <linux/soundcard.h>
>  #include <sound/initval.h>
>  #include <sound/mixer_oss.h>
> +#include <linux/delay.h>
>  
>  #define OSS_ALSAEMULVER		_SIOR ('M', 249, int)
>  
> @@ -1281,6 +1282,8 @@ snd_pcm_sframes_t snd_pcm_oss_read3(struct snd_pcm_substream *substream, char *p
>  		if (ret < 0)
>  			break;
>  		mutex_unlock(&runtime->oss.params_lock);
> +		pr_info("mdelay before __snd_pcm_lib_xfer\n");
> +		mdelay(1000);
>  		ret = __snd_pcm_lib_xfer(substream, (void *)ptr, true,
>  					 frames, in_kernel);
>  		mutex_lock(&runtime->oss.params_lock);
> @@ -2862,7 +2865,13 @@ static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait)
>  			struct snd_pcm_oss_file ofile;
>  			memset(&ofile, 0, sizeof(ofile));
>  			ofile.streams[SNDRV_PCM_STREAM_CAPTURE] = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
> -			runtime->oss.trigger = 0;
> +			// runtime->oss.trigger = 0;
> +			u8 *p = (u8 *)&runtime->oss;
> +			u8 v = READ_ONCE(*p);
> +			pr_info("delay between bitfield RMW\n");
> +			mdelay(100);
> +			v &= ~0x4;
> +			WRITE_ONCE(*p, v);
>  			snd_pcm_oss_set_trigger(&ofile, PCM_ENABLE_INPUT);
>  		}
>  	}
> 
> -----------------------------------------------------------------------
> 3. KASAN crash log
> -----------------------------------------------------------------------
> BUG: KASAN: slab-use-after-free in memcpy_to_iter lib/iov_iter.c:77 [inline]
> BUG: KASAN: slab-use-after-free in iterate_kvec include/linux/iov_iter.h:86 [inline]
> BUG: KASAN: slab-use-after-free in iterate_and_advance2 include/linux/iov_iter.h:308 [inline]
> BUG: KASAN: slab-use-after-free in iterate_and_advance include/linux/iov_iter.h:330 [inline]
> BUG: KASAN: slab-use-after-free in _copy_to_iter+0xa10/0x1480 lib/iov_iter.c:197
> Write of size 8192 at addr ff11000013ff4000 by task race/350
> CPU: 1 UID: 0 PID: 350 Comm: race Not tainted 6.19.13-dirty #14 NONE
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x8f/0xc0 lib/dump_stack.c:120
>  print_address_description mm/kasan/report.c:378 [inline]
>  print_report+0xd0/0x270 mm/kasan/report.c:482
>  kasan_report+0x118/0x150 mm/kasan/report.c:595
>  check_region_inline mm/kasan/generic.c:-1 [inline]
>  kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200
>  __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106
>  memcpy_to_iter lib/iov_iter.c:77 [inline]
>  iterate_kvec include/linux/iov_iter.h:86 [inline]
>  iterate_and_advance2 include/linux/iov_iter.h:308 [inline]
>  iterate_and_advance include/linux/iov_iter.h:330 [inline]
>  _copy_to_iter+0xa10/0x1480 lib/iov_iter.c:197
>  copy_to_iter include/linux/uio.h:220 [inline]
>  default_read_copy+0x11f/0x1b0 sound/core/pcm_lib.c:2092
>  do_transfer sound/core/pcm_lib.c:-1 [inline]
>  interleaved_copy+0x191/0x200 sound/core/pcm_lib.c:2141
>  __snd_pcm_lib_xfer+0x1165/0x1890 sound/core/pcm_lib.c:2380
>  snd_pcm_oss_read3+0x2ca/0x410 sound/core/oss/pcm_oss.c:1286
>  snd_pcm_plug_read_transfer+0x259/0x2f0 sound/core/oss/pcm_plugin.c:663
>  snd_pcm_oss_read2+0x1c7/0x3b0 sound/core/oss/pcm_oss.c:1487
>  snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1525 [inline]
>  snd_pcm_oss_read+0x3d0/0x7b0 sound/core/oss/pcm_oss.c:2778
>  vfs_read+0x15b/0x8a0 fs/read_write.c:570
>  ksys_read+0xca/0x190 fs/read_write.c:715
>  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>  do_syscall_64+0x6e/0x6a0 arch/x86/entry/syscall_64.c:94
>  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> RIP: 0033:0x7bdf3b94d2dc
> Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 59 d5 f8 ff 48 8b 54 24 18 48 8b 74 248
> RSP: 002b:00007bdf3b04fe70 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
> RAX: ffffffffffffffda RBX: 00007bdf3b0506c0 RCX: 00007bdf3b94d2dc
> RDX: 0000000000000001 RSI: 00007bdf3b04fec7 RDI: 0000000000000003
> RBP: 00007bdf3b04fed0 R08: 0000000000000000 R09: 00007ffe6810a877
> R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff80
> R13: 0000000000000000 R14: 00007ffe6810a780 R15: 00007bdf3a850000
>  </TASK>
> Allocated by task 350:
>  kasan_save_stack mm/kasan/common.c:57 [inline]
>  kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
>  poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
>  __kasan_kmalloc+0x72/0x90 mm/kasan/common.c:415
>  kasan_kmalloc include/linux/kasan.h:263 [inline]
>  __do_kmalloc_node mm/slub.c:5754 [inline]
>  __kvmalloc_node_noprof+0x3a3/0x710 mm/slub.c:7261
>  snd_pcm_plugin_alloc+0x183/0x700 sound/core/oss/pcm_plugin.c:74
>  snd_pcm_plug_alloc+0x14a/0x270 sound/core/oss/pcm_plugin.c:133
>  snd_pcm_oss_change_params_locked+0x2190/0x3440 sound/core/oss/pcm_oss.c:1043
>  snd_pcm_oss_make_ready_locked sound/core/oss/pcm_oss.c:1191 [inline]
>  snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1520 [inline]
>  snd_pcm_oss_read+0x247/0x7b0 sound/core/oss/pcm_oss.c:2778
>  vfs_read+0x15b/0x8a0 fs/read_write.c:570
>  ksys_read+0xca/0x190 fs/read_write.c:715
>  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>  do_syscall_64+0x6e/0x6a0 arch/x86/entry/syscall_64.c:94
>  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> Freed by task 349:
>  kasan_save_stack mm/kasan/common.c:57 [inline]
>  kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
>  kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
>  poison_slab_object mm/kasan/common.c:253 [inline]
>  __kasan_slab_free+0x3a/0x60 mm/kasan/common.c:285
>  kasan_slab_free include/linux/kasan.h:235 [inline]
>  slab_free_hook mm/slub.c:2580 [inline]
>  slab_free mm/slub.c:6791 [inline]
>  kfree+0x169/0x3f0 mm/slub.c:7003
>  snd_pcm_plugin_free+0xb2/0xd0 sound/core/oss/pcm_plugin.c:198
>  snd_pcm_oss_plugin_clear sound/core/oss/pcm_oss.c:541 [inline]
>  snd_pcm_oss_change_params_locked+0x1bd5/0x3440 sound/core/oss/pcm_oss.c:974
>  snd_pcm_oss_change_params sound/core/oss/pcm_oss.c:1109 [inline]
>  snd_pcm_oss_make_ready+0xdf/0x270 sound/core/oss/pcm_oss.c:1168
>  snd_pcm_oss_set_trigger+0x87/0x6c0 sound/core/oss/pcm_oss.c:2083
>  snd_pcm_oss_poll+0x739/0x870 sound/core/oss/pcm_oss.c:2873
>  vfs_poll include/linux/poll.h:82 [inline]
>  select_poll_one fs/select.c:480 [inline]
>  do_select+0xbdb/0x11c0 fs/select.c:536
>  core_sys_select+0x4dc/0x720 fs/select.c:677
>  do_pselect fs/select.c:759 [inline]
>  __do_sys_pselect6 fs/select.c:798 [inline]
>  __se_sys_pselect6+0x18d/0x1f0 fs/select.c:789
>  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>  do_syscall_64+0x6e/0x6a0 arch/x86/entry/syscall_64.c:94
>  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> The buggy address belongs to the object at ff11000013ff4000
>  which belongs to the cache kmalloc-8k of size 8192
> The buggy address is located 0 bytes inside of
>  freed 8192-byte region [ff11000013ff4000, ff11000013ff6000)
> The buggy address belongs to the physical page:
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13ff0
> head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> flags: 0x100000000000040(head|node=0|zone=1)
> page_type: f5(slab)
> raw: 0100000000000040 ff1100000ac38280 ffd40000004ffa00 0000000000000006
> raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
> head: 0100000000000040 ff1100000ac38280 ffd40000004ffa00 0000000000000006
> head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
> head: 0100000000000003 ffd40000004ffc01 00000000ffffffff 00000000ffffffff
> head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> page dumped because: kasan: bad access detected
> Memory state around the buggy address:
>  ff11000013ff3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>  ff11000013ff3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> >ff11000013ff4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>                    ^
>  ff11000013ff4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>  ff11000013ff4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ==================================================================
> 
> -----------------------------------------------------------------------
> 4. Proposed fix
> -----------------------------------------------------------------------
> Split the four packed bit-flags into independent bytes so they no
> longer share a storage word. Writes to one flag can then no longer
> corrupt the others regardless of locking.
> 
> Another possible fix direction may be to take `runtime->oss.params_lock` 
> in the poll path before touching `runtime->oss.trigger`, 
> since `snd_pcm_oss_poll()` appears to be the only writer 
> of these flags that currently does not use that mutex.
> 
> Because we found this through fuzzing and do not know the subsystem
> well, I am not confident that the patch below is the best fix. It is
> just the smallest change that seemed reasonable from code inspection.
> 
> diff --git a/include/sound/pcm_oss.h b/include/sound/pcm_oss.h
> --- a/include/sound/pcm_oss.h
> +++ b/include/sound/pcm_oss.h
> @@ -22,10 +22,10 @@ struct snd_pcm_oss_setup {
>  };
>  
>  struct snd_pcm_oss_runtime {
> -	unsigned params: 1,			/* format/parameter change */
> -		 prepare: 1,			/* need to prepare the operation */
> -		 trigger: 1,			/* trigger flag */
> -		 sync_trigger: 1;		/* sync trigger flag */
> +	unsigned char params;			/* format/parameter change */
> +	unsigned char prepare;			/* need to prepare the operation */
> +	unsigned char trigger;			/* trigger flag */
> +	unsigned char sync_trigger;		/* sync trigger flag */
>  	int rate;				/* requested rate */
>  	int format;				/* requested OSS format */
>  	unsigned int channels;			/* requested channels */

Thanks for the report.  I see the point, and IMO, a better fix is to
protect runtime->oss.trigger access with the mutex.  We can change the
bit fields to bool as a separate patch, but it shouldn't be considered
as an ad hoc fix.

Could you submit a proper patch after verifying that it fixes your
fuzzer?


thanks,

Takashi