Re: [BUG] KASAN: slab-use-after-free in ALSA OSS read/poll race

[Takashi Iwai <tiwai@suse.de>]

On Fri, 24 Apr 2026 12:12:41 +0200,
Jaeyoung Chung wrote:
> 
> On Fri, Apr 24, 2026 at 5:28 PM Takashi Iwai <tiwai@suse.de> wrote:
> >
> > Does something below work?
> > Once after confirming, I'll submit a proper patch.
> >
> >
> > thanks,
> >
> > Takashi
> >
> > -- 8< --
> > diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
> > --- a/sound/core/oss/pcm_oss.c
> > +++ b/sound/core/oss/pcm_oss.c
> > @@ -2155,10 +2155,16 @@ static int snd_pcm_oss_get_trigger(struct snd_pcm_oss_file *pcm_oss_file)
> >
> >         psubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
> >         csubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
> > -       if (psubstream && psubstream->runtime && psubstream->runtime->oss.trigger)
> > -               result |= PCM_ENABLE_OUTPUT;
> > -       if (csubstream && csubstream->runtime && csubstream->runtime->oss.trigger)
> > -               result |= PCM_ENABLE_INPUT;
> > +       if (psubstream && psubstream->runtime) {
> > +               guard(mutex)(&psubstream->runtime->oss.params_lock);
> > +               if (psubstream->runtime->oss.trigger)
> > +                       result |= PCM_ENABLE_OUTPUT;
> > +       }
> > +       if (csubstream && csubstream->runtime) {
> > +               guard(mutex)(&csubstream->runtime->oss.params_lock);
> > +               if (csubstream->runtime->oss.trigger)
> > +                       result |= PCM_ENABLE_INPUT;
> > +       }
> >         return result;
> >  }
> >
> > @@ -2832,6 +2838,17 @@ static int snd_pcm_oss_capture_ready(struct snd_pcm_substream *substream)
> >                                                 runtime->oss.period_frames;
> >  }
> >
> > +static bool need_input_retrigger(struct snd_pcm_runtime *runtime)
> > +{
> > +       bool ret;
> > +
> > +       guard(mutex)(&runtime->oss.params_lock);
> > +       ret = runtime->oss.trigger;
> > +       if (ret)
> > +               runtime->oss.trigger = 0;
> > +       return ret;
> > +}
> > +
> >  static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait)
> >  {
> >         struct snd_pcm_oss_file *pcm_oss_file;
> > @@ -2864,11 +2881,11 @@ static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait)
> >                             snd_pcm_oss_capture_ready(csubstream))
> >                                 mask |= EPOLLIN | EPOLLRDNORM;
> >                 }
> > -               if (ostate != SNDRV_PCM_STATE_RUNNING && runtime->oss.trigger) {
> > +               if (ostate != SNDRV_PCM_STATE_RUNNING &&
> > +                   need_input_retrigger(runtime)) {
> >                         struct snd_pcm_oss_file ofile;
> >                         memset(&ofile, 0, sizeof(ofile));
> >                         ofile.streams[SNDRV_PCM_STREAM_CAPTURE] = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
> > -                       runtime->oss.trigger = 0;
> >                         snd_pcm_oss_set_trigger(&ofile, PCM_ENABLE_INPUT);
> >                 }
> >         }
> >
> >
> 
> Thanks for the quick fix.
> 
> The patch looks good to me. I tested it on my side and no longer
> see the KASAN report.

Good to hear.  I'm going to submit a formal patch.
Thank you for quick testing!


Takashi