ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()

In the drain loop, the local variable 'runtime' is reassigned to a
linked stream's runtime (runtime = s->runtime at line 2157).  After
releasing the stream lock at line 2169, the code accesses
runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size
(lines 2170-2178) — all referencing the linked stream's runtime without
any lock or refcount protecting its lifetime.

A concurrent close() on the linked stream's fd triggers
snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private()
→ snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime).
No synchronization prevents kfree(runtime) from completing while the
drain path dereferences the stale pointer.

Fix by caching the needed runtime fields (no_period_wakeup, rate,
buffer_size) into local variables while still holding the stream lock,
and using the cached values after the lock is released.

Fixes: f2b3614cefb6 ("ALSA: PCM - Don't check DMA time-out too shortly")
Cc: stable@vger.kernel.org
Signed-off-by: Mehul Rao <mehulrao@gmail.com>
Link: https://patch.msgid.link/20260305193508.311096-1-mehulrao@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 67cf6a0e17ba8d636ce5003186e5fd282cec76cb..5a64453da7283a660320c804a9ed9153449b8900 100644 (file)
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2144,6 +2144,10 @@ static int snd_pcm_drain(struct snd_pcm_substream *substream,
        for (;;) {
                long tout;
                struct snd_pcm_runtime *to_check;
+               unsigned int drain_rate;
+               snd_pcm_uframes_t drain_bufsz;
+               bool drain_no_period_wakeup;
+
                if (signal_pending(current)) {
                        result = -ERESTARTSYS;
                        break;
@@ -2163,16 +2167,25 @@ static int snd_pcm_drain(struct snd_pcm_substream *substream,
                snd_pcm_group_unref(group, substream);
                if (!to_check)
                        break; /* all drained */
+               /*
+                * Cache the runtime fields needed after unlock.
+                * A concurrent close() on the linked stream may free
+                * its runtime via snd_pcm_detach_substream() once we
+                * release the stream lock below.
+                */
+               drain_no_period_wakeup = to_check->no_period_wakeup;
+               drain_rate = to_check->rate;
+               drain_bufsz = to_check->buffer_size;
                init_waitqueue_entry(&wait, current);
                set_current_state(TASK_INTERRUPTIBLE);
                add_wait_queue(&to_check->sleep, &wait);
                snd_pcm_stream_unlock_irq(substream);
-               if (runtime->no_period_wakeup)
+               if (drain_no_period_wakeup)
                        tout = MAX_SCHEDULE_TIMEOUT;
                else {
                        tout = 100;
-                       if (runtime->rate) {
-                               long t = runtime->buffer_size * 1100 / runtime->rate;
+                       if (drain_rate) {
+                               long t = drain_bufsz * 1100 / drain_rate;
                                tout = max(t, tout);
                        }
                        tout = msecs_to_jiffies(tout);