[PATCH] ALSA: wavefront: Fix use-after-free in MIDI operations

[PATCH] ALSA: wavefront: Fix use-after-free in MIDI operations

[moonafterrain]

From: Junrui Luo <moonafterrain@outlook.com>

Clear substream pointers in close functions to prevent use-after-free
when timer callbacks or interrupt handlers access them after close.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
 sound/isa/wavefront/wavefront_midi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/isa/wavefront/wavefront_midi.c b/sound/isa/wavefront/wavefront_midi.c
index 1250ecba659a..69d87c4cafae 100644
--- a/sound/isa/wavefront/wavefront_midi.c
+++ b/sound/isa/wavefront/wavefront_midi.c
@@ -278,6 +278,7 @@ static int snd_wavefront_midi_input_close(struct snd_rawmidi_substream *substrea
 	        return -EIO;
 
 	guard(spinlock_irqsave)(&midi->open);
+	midi->substream_input[mpu] = NULL;
 	midi->mode[mpu] &= ~MPU401_MODE_INPUT;
 
 	return 0;
@@ -300,6 +301,7 @@ static int snd_wavefront_midi_output_close(struct snd_rawmidi_substream *substre
 	        return -EIO;
 
 	guard(spinlock_irqsave)(&midi->open);
+	midi->substream_output[mpu] = NULL;
 	midi->mode[mpu] &= ~MPU401_MODE_OUTPUT;
 	return 0;
 }
-- 
2.51.1.dirty

Re: [PATCH] ALSA: wavefront: Fix use-after-free in MIDI operations

[Takashi Iwai]

On Tue, 04 Nov 2025 15:11:55 +0100,
moonafterrain@outlook.com wrote:
> 
> From: Junrui Luo <moonafterrain@outlook.com>
> 
> Clear substream pointers in close functions to prevent use-after-free
> when timer callbacks or interrupt handlers access them after close.

There can be no actual access done because MPU401_MODE_INPUT_TRIGGER
is guaranteed to be off before closing the stream.  That is, the
variable stream is assigned to an old pointer, but it's not accessed.
So, this is not really a use-after-free bug, per se.

Other than that, the fix itself looks good.  Please resubmit after
rephrasing the patch description.


thanks,

Takashi


> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Reported-by: Junrui Luo <moonafterrain@outlook.com>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
> ---
>  sound/isa/wavefront/wavefront_midi.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/sound/isa/wavefront/wavefront_midi.c b/sound/isa/wavefront/wavefront_midi.c
> index 1250ecba659a..69d87c4cafae 100644
> --- a/sound/isa/wavefront/wavefront_midi.c
> +++ b/sound/isa/wavefront/wavefront_midi.c
> @@ -278,6 +278,7 @@ static int snd_wavefront_midi_input_close(struct snd_rawmidi_substream *substrea
>  	        return -EIO;
>  
>  	guard(spinlock_irqsave)(&midi->open);
> +	midi->substream_input[mpu] = NULL;
>  	midi->mode[mpu] &= ~MPU401_MODE_INPUT;
>  
>  	return 0;
> @@ -300,6 +301,7 @@ static int snd_wavefront_midi_output_close(struct snd_rawmidi_substream *substre
>  	        return -EIO;
>  
>  	guard(spinlock_irqsave)(&midi->open);
> +	midi->substream_output[mpu] = NULL;
>  	midi->mode[mpu] &= ~MPU401_MODE_OUTPUT;
>  	return 0;
>  }
> -- 
> 2.51.1.dirty
>