Re: [PATCH] ALSA: pcm_oss: Fix use-after-free in poll via io_uring

[Takashi Iwai]

On Thu, 30 Apr 2026 04:14:01 +0200,
songxiebing wrote:
> 
> From: Bob Song <songxiebing@xxxxxxxxxx>
> 
> Fix use-after-free bug in snd_pcm_oss_poll() caused by
> io_uring asynchronous poll operations accessing already-freed
> pcm_oss_file private data.
> 
> The bug happens because file->private_data still points to
> kfree()'d memory after snd_pcm_oss_release(), and io_uring
> may invoke ->poll() handler later.
> 
> Fix by:
> 1. Clearing file->private_data early in release function
> 2. Adding NULL check in release to avoid invalid access
> 3. Adding NULL check in poll handler to prevent UAF
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") /* pcm_oss initial */
> Reported-by: syzbot+ee73befabe68e7907adf@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://lore.kernel.org/alsa-devel/000000000000f1068105f20e5e8f@xxxxxxxxxx/

This is a very old report.  Are you sure that it's still valid with
the latest kernel?
I believe this kind of bug should have been already fixed.
(And above all, the suggested code change doesn't look enough as a
proper fix.)

The same question applied for your other two patches for rawmidi and
PCM UAFs.


thanks,

Takashi