[PATCH] ALSA: rawmidi: Fix use-after-free in poll via io_uring

[songxiebing]

From: Bob Song <songxiebing@xxxxxxxxxx>

Io_uring may perform async poll after the file is closed and
private data is freed. Fix UAF by clearing private_data in
release function and adding NULL checks in poll.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+e3ec01fd2d18c9264c3b@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://lore.kernel.org/alsa-devel/0000000000005ea9dd05f20e5b48@xxxxxxxxxx/
Signed-off-by: Bob Song <songxiebing@xxxxxxxxxx>
---
 sound/core/rawmidi.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 3b1034a44938..7973bace2ac5 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -606,6 +606,10 @@ static int snd_rawmidi_release(struct inode *inode, struct file *file)
 	struct module *module;
 
 	rfile = file->private_data;
+	if (!rfile)
+		return 0;
+
+	file->private_data = NULL;
 	rmidi = rfile->rmidi;
 	rawmidi_release_priv(rfile);
 	kfree(rfile);
@@ -1665,6 +1669,11 @@ static __poll_t snd_rawmidi_poll(struct file *file, poll_table *wait)
 	__poll_t mask;
 
 	rfile = file->private_data;
+
+	/* Prevent UAF from async io_uring poll after release */
+	if (!rfile)
+		return EPOLLERR | EPOLLHUP;
+
 	if (rfile->input != NULL) {
 		runtime = rfile->input->runtime;
 		snd_rawmidi_input_trigger(rfile->input, 1);
-- 
2.25.1