[PATCH] ALSA: jack: Pin the module while debugfs files are open

[PATCH] ALSA: jack: Pin the module while debugfs files are open

[Cen Zhang]

With CONFIG_SND=m and CONFIG_SND_JACK_INJECTION_DEBUG enabled, an in-tree
HDA jack creates these debugfs files through snd_jack_new() and
snd_jack_add_debugfs(). Their file_operations live in snd, but none sets
.owner. full_proxy_open_regular() therefore takes no snd module reference
when it calls fops_get(real_fops).

A debugfs descriptor can outlive removal of its HDA card. Once the card
and dependent modules, including the OSS emulation modules, have been
removed, snd can be unloaded while that descriptor is still open:

  Descriptor holder                   Card/module teardown
  -----------------                   --------------------
  open jack debugfs file
    full_proxy_open_regular()
      fops_get(real_fops)
        owner == NULL: no snd pin
  keep descriptor open
                                      remove HDA card
                                        snd_card_disconnect()
                                          snd_jack_dev_disconnect()
                                          remove debugfs nodes
                                        snd_jack_dev_free()
                                      unload dependent modules
                                      rmmod snd
                                        alsa_sound_exit()
                                        free_module(): unmap snd
  close descriptor
    full_proxy_release()
      read real_fops->release
      fops_put(real_fops)
        read real_fops->owner

debugfs_remove() drains active operations, but does not wait for idle
open descriptors. Release deliberately bypasses removal protection and
reads the real table even when no release callback is installed. The
last close can therefore access unloaded snd storage.

Set .owner to THIS_MODULE in all six tables. The existing proxy
fops_get()/fops_put() pair then keeps snd loaded through the final table
access on close.

Fixes: 2d670ea2bd53 ("ALSA: jack: implement software jack injection via debugfs")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>

---

diff --git a/sound/core/jack.c b/sound/core/jack.c
index 0f04018181acb20f6bf85b11a9f6d4c7d3179e5a..4451249d055d028c8aa2757d75d0706fa47b4ad7 100644
--- a/sound/core/jack.c
+++ b/sound/core/jack.c
@@ -303,6 +303,7 @@ static ssize_t jack_type_read(struct file *file,
 }
 
 static const struct file_operations jack_type_fops = {
+	.owner	=	THIS_MODULE,
 	.open	=	simple_open,
 	.read	=	jack_type_read,
 	.llseek	=	default_llseek,
@@ -310,6 +311,7 @@ static const struct file_operations jack_type_fops = {
 #endif
 
 static const struct file_operations sw_inject_enable_fops = {
+	.owner	=	THIS_MODULE,
 	.open	=	simple_open,
 	.read	=	sw_inject_enable_read,
 	.write	=	sw_inject_enable_write,
@@ -317,24 +319,28 @@ static const struct file_operations sw_inject_enable_fops = {
 };
 
 static const struct file_operations jackin_inject_fops = {
+	.owner	=	THIS_MODULE,
 	.open	=	simple_open,
 	.write	=	jackin_inject_write,
 	.llseek	=	default_llseek,
 };
 
 static const struct file_operations jack_kctl_id_fops = {
+	.owner	=	THIS_MODULE,
 	.open	=	simple_open,
 	.read	=	jack_kctl_id_read,
 	.llseek	=	default_llseek,
 };
 
 static const struct file_operations jack_kctl_mask_bits_fops = {
+	.owner	=	THIS_MODULE,
 	.open	=	simple_open,
 	.read	=	jack_kctl_mask_bits_read,
 	.llseek	=	default_llseek,
 };
 
 static const struct file_operations jack_kctl_status_fops = {
+	.owner	=	THIS_MODULE,
 	.open	=	simple_open,
 	.read	=	jack_kctl_status_read,
 	.llseek	=	default_llseek,

Re: [PATCH] ALSA: jack: Pin the module while debugfs files are open

[Takashi Iwai]

On Mon, 19 Oct 2026 12:30:54 +0200,
Cen Zhang wrote:
> 
> With CONFIG_SND=m and CONFIG_SND_JACK_INJECTION_DEBUG enabled, an in-tree
> HDA jack creates these debugfs files through snd_jack_new() and
> snd_jack_add_debugfs(). Their file_operations live in snd, but none sets
> .owner. full_proxy_open_regular() therefore takes no snd module reference
> when it calls fops_get(real_fops).
> 
> A debugfs descriptor can outlive removal of its HDA card. Once the card
> and dependent modules, including the OSS emulation modules, have been
> removed, snd can be unloaded while that descriptor is still open:
> 
>   Descriptor holder                   Card/module teardown
>   -----------------                   --------------------
>   open jack debugfs file
>     full_proxy_open_regular()
>       fops_get(real_fops)
>         owner == NULL: no snd pin
>   keep descriptor open
>                                       remove HDA card
>                                         snd_card_disconnect()
>                                           snd_jack_dev_disconnect()
>                                           remove debugfs nodes
>                                         snd_jack_dev_free()
>                                       unload dependent modules
>                                       rmmod snd
>                                         alsa_sound_exit()
>                                         free_module(): unmap snd
>   close descriptor
>     full_proxy_release()
>       read real_fops->release
>       fops_put(real_fops)
>         read real_fops->owner
> 
> debugfs_remove() drains active operations, but does not wait for idle
> open descriptors. Release deliberately bypasses removal protection and
> reads the real table even when no release callback is installed. The
> last close can therefore access unloaded snd storage.
> 
> Set .owner to THIS_MODULE in all six tables. The existing proxy
> fops_get()/fops_put() pair then keeps snd loaded through the final table
> access on close.
> 
> Fixes: 2d670ea2bd53 ("ALSA: jack: implement software jack injection via debugfs")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>

Applied now.  Thanks.


Takashi