Re: [PATCH] ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

[Takashi Iwai <tiwai@suse.de>]

On Thu, 04 Jun 2026 16:25:59 +0200,
Ji'an Zhou wrote:
> 
> snd_pcm_drain() uses init_waitqueue_entry which does not clear
> entry.prev/next, and add_wait_queue with a conditional
> remove_wait_queue that is skipped when to_check is no longer
> in the group after concurrent UNLINK.  The orphaned wait entry
> remains on the unlinked substream sleep queue.  On the next
> drain iteration, add_wait_queue adds the entry to a new queue
> while still linked on the old one, corrupting both lists.  A
> subsequent wake_up dereferences NULL at the func pointer
> (mapped from the spinlock at offset 0 of the misinterpreted
> wait_queue_head_t), causing a kernel panic.
> 
> Replace init_waitqueue_entry/add_wait_queue/conditional
> remove_wait_queue with init_wait_entry/prepare_to_wait/
> finish_wait.  init_wait_entry clears prev/next via
> INIT_LIST_HEAD on each iteration and sets
> autoremove_wake_function which auto-removes the entry on
> wake-up.  finish_wait safely handles both the already-removed
> and still-queued cases.
> 
> Fixes: 9b1dbd69ba6f ("ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain")
> Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>

Applied now.  Thanks.


Takashi