Re: [PATCH] ALSA: pcm: Fix NULL dereference in import_ubuf() during exit

[Takashi Iwai <tiwai@suse.de>]

On Tue, 26 May 2026 03:32:45 +0200,
Jiakai Xu wrote:
> 
> snd_pcm_oss_sync() calls snd_pcm_lib_write(substream, NULL, size) to
> fill silence.  The in_kernel flag is hard-coded to false by the wrapper,
> so do_transfer() falls through to import_ubuf() with a garbage pointer
> (NULL + frame_offset).  When the process is in do_exit() and current->mm
> is already NULL, import_ubuf()'s access_ok() crashes dereferencing 
> mm->context.pmlen.
> 
> Add a NULL guard in do_transfer() to use iov_iter_kvec() with a dummy
> kvec for the fill_silence path, avoiding the import_ubuf() call.  The
> fill_silence transfer function ignores the iov_iter, so the dummy kvec
> is safe.
> 
> Fixes: cf393babb37a1 ("ALSA: pcm: Add copy ops with iov_iter")
> Signed-off-by: Jiakai Xu <xujiakai24@mails.ucas.ac.cn>

This is already fixed by the upstream commit e4d3386b74fb ("ALSA: pcm:
Don't setup bogus iov_iter for silencing").


thanks,

Takashi