Re: [PATCH] ALSA: seq: oss: Initialize the timer before publishing the port

[Takashi Iwai]

On Sat, 17 Oct 2026 09:01:49 +0200,
Cen Zhang wrote:
> 
> An OSS sequencer port must have an initialized timer before MIDI input
> can reach send_midi_event(). snd_seq_oss_open() publishes the callback
> port and assigns dp->readq before allocating dp->timer.
> 
> A client owning a MIDI port that another OSS session has opened for
> reading can submit a direct event to the new OSS port. Direct delivery
> does not require a subscription to the destination, and
> snd_seq_oss_midi_input() checks the source alias's readable-open bit
> without requiring that alias to belong to the destination session.
> For a read-capable /dev/sequencer open, this permits the following order:
> 
>   OSS open                         Direct MIDI input
>   create_port(dp)
>   dp->readq = ...
>                                    snd_seq_write() to the new port
>                                    snd_seq_oss_midi_input()
>                                    send_midi_event()
>                                      dp->timer->running
>   dp->timer = snd_seq_oss_timer_new(dp)
> 
> The callback dereferences a NULL timer in this interval. The OSS
> register_mutex does not cover event callbacks, and the destination
> port's use reference only protects the session's lifetime.
> 
> Initialize the timer before creating the callback port, so the existing
> port publication also publishes the initialized timer. The timer
> constructor does not need a queue or a port. Use free_devinfo() when no
> port was created to release the timer on failures.
> 
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>
> Assisted-by: LLM

This issue should have been covered by my recent fix:
  https://patch.msgid.link/20261016161930.482309-1-tiwai@xxxxxxx


thanks,

Takashi