Re: [PATCH] ALSA: aloop: Keep the timer source alive until card release

[Takashi Iwai]

On Mon, 19 Oct 2026 11:06:13 +0200,
Cen Zhang wrote:
> 
> The timer_source string must remain valid while PCM opens can select
> and parse it. loopback_set_timer_source() allocates the string with
> parent-device devres, which can release it while the card is still
> registered.
> 
> A successful nonempty proc replacement after snd_card_register() adds
> the string allocation after trigger_card_free. Unbinding the platform
> device while snd_aloop remains loaded releases devres in reverse order.
> An open for an unused cable can run after the string is freed and before
> the card-free action disconnects the card:
> 
>   Device unbind                      PCM open
>   devres_release_all()
>     free replacement string
>                                      snd_pcm_open()
>                                        snd_card_file_add()
>                                        loopback_open()
>                                          loopback_snd_timer_open()
>                                            loopback_parse_timer_id()
>     trigger_card_free()
>       snd_card_free()
>         snd_card_disconnect()
> 
> The parser can then read freed memory. KASAN has reported a one-byte
> use-after-free read in strchr() from loopback_snd_timer_open(). The
> cable_lock mutex serializes explicit replacements with opens, but
> implicit devres release does not take it. The card and module references
> held by PCM open do not retain this separate devres allocation.
> 
> Use kstrdup() and release the current string from card->private_free.
> PCM admission already retains the card until each file is removed, and
> card disconnect drains proc callbacks before final card release. This
> keeps the string alive across admitted PCM opens and preserves the
> cable_lock serialization of replacements. Install the callback before
> the initial allocation so probe failures also release the string.
> 
> Fixes: b072e65aadd6 ("ALSA: aloop: Allocate resources with device-managed APIs")
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>
> Assisted-by: LLM

Applied now.  Thanks.


Takashi