From f9e882ac8257bc55a8c99399e504e434d9e72eb9 Mon Sep 17 00:00:00 2001 From: Cen Zhang Date: Mon, 12 Oct 2026 00:02:50 +0800 Subject: [PATCH] ALSA: timer: Pin the module for userspace timer controllers The static snd_utimer_ids IDA must remain live until a userspace timer controller has returned its ID. However, snd_utimer_fops has no owner, so anon_inode_getfd() does not take a reference to snd-timer for the controller file. With CONFIG_SND_TIMER=m and CONFIG_SND_UTIMER=y, userspace can create a controller with SNDRV_TIMER_IOCTL_CREATE and close the native timer file. If no timer instances or dependent modules retain snd-timer, ordinary module unload can then overlap the controller's final release: Controller final release Module unload snd_utimer_release() snd_utimer_free() snd_timer_free(): unlink provider snd_utimer_put_id() enter ida_free() delete_module() alsa_timer_exit() free_module(): free MOD_DATA access snd_utimer_ids.xa The provider is already absent from snd_timer_free_all() when unload runs. Neither register_mutex nor the IDA's lock keeps module storage resident through the remaining IDA access. That access can therefore use freed module data and fault while acquiring the XArray lock, as shown in the Oops below. Set snd_utimer_fops.owner to THIS_MODULE so anonymous-file creation takes the existing module reference. The VFS drops it only after snd_utimer_release() returns, keeping the IDA resident through ida_free() and preventing ordinary unload during that interval. Oops report as below: BUG: unable to handle page fault for address: fffffbfff80480af #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1a7ff6067 P4D 1a7ff6067 PUD 1a7ff2067 PMD 100ad6067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 485 Comm: alsa-utimer-fix Tainted: G O 7.2.0-rc6-pmb-bt-functional-v1+ #1 PREEMPT(lazy) Tainted: [O]=OOT_MODULE Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:kasan_byte_accessible+0x15/0x30 Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 69 f1 2b ff 66 66 2e 0f 1f 84 00 00 00 RSP: 0018:ffff88811a457c48 EFLAGS: 00010086 RAX: dffffc0000000000 RBX: ffffffffc0240578 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff861f111c RDI: fffffbfff80480af RBP: ffffffffc0240578 R08: 0000000000000001 R09: 0000000000000000 R10: ffffffff891cc057 R11: ffff88811531ba00 R12: ffffffff861f111c R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007ff190ff7780(0000) GS:ffff8881fda2a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80480af CR3: 0000000116890003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: __kasan_check_byte+0x13/0x50 lock_acquire+0x113/0x2f0 ? __pfx_pmbd_probe_hit_cookie+0x10/0x10 ? lock_release+0xc8/0x280 ? srso_alias_return_thunk+0x5/0xfbef5 _raw_spin_lock_irqsave+0x3c/0x60 ? ida_free+0xd4/0x2b0 ida_free+0xd4/0x2b0 ? __pfx_ida_free+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __pfx_locks_remove_file+0x10/0x10 ? __fput+0x39f/0xa60 ? fput_close_sync+0xff/0x200 ? __pfx_fput_close_sync+0x10/0x10 ? dnotify_flush+0x22/0x4b0 ? __x64_sys_close+0x8c/0xf0 ? do_syscall_64+0x115/0x6a0 ? entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: snd(O) [last unloaded: snd_timer(O)] CR2: fffffbfff80480af ---[ end trace 0000000000000000 ]--- Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers") Assisted-by: LLM Signed-off-by: Cen Zhang Link: https://patch.msgid.link/pm-pmb-98fb8f747fc7b8499fd4-v2-1c531f149a6d6c084f48@gmail.com Signed-off-by: Takashi Iwai --- sound/core/timer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/core/timer.c b/sound/core/timer.c index 69a59b25fe0a..905176bf6948 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -2173,6 +2173,7 @@ static long snd_utimer_ioctl(struct file *file, unsigned int ioctl, unsigned lon } static const struct file_operations snd_utimer_fops = { + .owner = THIS_MODULE, .llseek = noop_llseek, .release = snd_utimer_release, .unlocked_ioctl = snd_utimer_ioctl,