Re: [PATCH v2] usb: gadget: u_audio: call period elapsed under the stream lock

[sashiko-bot@kernel.org]

> u_audio_iso_complete() drops the substream stream lock before
> calling snd_pcm_period_elapsed(), which re-acquires it internally.
> Between the unlock and the re-acquire, a concurrent close can run
> through snd_pcm_drop(), finish the PCM release and free the runtime,
> leaving the period notification to dereference a freed runtime
> (runtime->fasync in snd_pcm_period_elapsed()).
> 
> Keep the stream lock across the period notification and use
> snd_pcm_period_elapsed_under_stream_lock(), the API for exactly this
> caller-held-lock case, so the callback's runtime access happens
> inside a single locked section.
> 
> On final PCM release, snd_pcm_drop() takes the stream lock before
> runtime detachment: an in-flight completion holding that lock
> finishes before STOP can proceed.  The STOP trigger clears prm->ss,
> so subsequent callbacks do not enter the running PCM path.  Runtime
> detachment happens later and is not itself protected by the stream
> lock.  On the gadget side, u_audio_stop_*() dequeues the requests
> before the endpoint is freed.
> 
> KASAN reported the use-after-free in u_audio_iso_complete() on the
> unmodified kernel.  With the callback stalled inside the locked
> section while a concurrent close ran, no use-after-free was reported
> after this change.
> 
> This issue was investigated and the fix was developed with AI
> assistance (ZCode/GLM-4).
> 
> Fixes: 773e53d50e227 ("usb: gadget: u_audio: remove cached period bytes value")
> Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105114309.970899-1-shunsheng1218@gmail.com?part=1