* [PATCH] ALSA: timer: Pin the module for userspace timer controllers
@ 2026-10-11 16:02 Cen Zhang
2026-10-12 7:25 ` Takashi Iwai
0 siblings, 1 reply; 2+ messages in thread
From: Cen Zhang @ 2026-10-11 16:02 UTC (permalink / raw)
To: perex, tiwai, norbert, kees+treewide, phucduc.bui,
danishkhateeb03, cassiogabrielcontato, maoyixie.tju,
ivan.orlov0322
Cc: linux-sound, linux-kernel, baijiaju1990, jjzuming, zzzccc427
The static snd_utimer_ids IDA must remain live until a userspace timer
controller has returned its ID. However, snd_utimer_fops has no owner,
so anon_inode_getfd() does not take a reference to snd-timer for the
controller file.
With CONFIG_SND_TIMER=m and CONFIG_SND_UTIMER=y, userspace can create a
controller with SNDRV_TIMER_IOCTL_CREATE and close the native timer
file. If no timer instances or dependent modules retain snd-timer,
ordinary module unload can then overlap the controller's final release:
Controller final release Module unload
snd_utimer_release()
snd_utimer_free()
snd_timer_free(): unlink provider
snd_utimer_put_id()
enter ida_free()
delete_module()
alsa_timer_exit()
free_module(): free MOD_DATA
access snd_utimer_ids.xa
The provider is already absent from snd_timer_free_all() when unload
runs. Neither register_mutex nor the IDA's lock keeps module storage
resident through the remaining IDA access. That access can therefore
use freed module data and fault while acquiring the XArray lock, as
shown in the Oops below.
Set snd_utimer_fops.owner to THIS_MODULE so anonymous-file creation
takes the existing module reference. The VFS drops it only after
snd_utimer_release() returns, keeping the IDA resident through
ida_free() and preventing ordinary unload during that interval.
Oops report as below:
BUG: unable to handle page fault for address: fffffbfff80480af
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1a7ff6067 P4D 1a7ff6067 PUD 1a7ff2067 PMD 100ad6067 PTE 0
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 485 Comm: alsa-utimer-fix Tainted: G O 7.2.0-rc6-pmb-bt-functional-v1+ #1 PREEMPT(lazy)
Tainted: [O]=OOT_MODULE
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:kasan_byte_accessible+0x15/0x30
Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 69 f1 2b ff 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffff88811a457c48 EFLAGS: 00010086
RAX: dffffc0000000000 RBX: ffffffffc0240578 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff861f111c RDI: fffffbfff80480af
RBP: ffffffffc0240578 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff891cc057 R11: ffff88811531ba00 R12: ffffffff861f111c
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 00007ff190ff7780(0000) GS:ffff8881fda2a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff80480af CR3: 0000000116890003 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<TASK>
__kasan_check_byte+0x13/0x50
lock_acquire+0x113/0x2f0
? __pfx_pmbd_probe_hit_cookie+0x10/0x10
? lock_release+0xc8/0x280
? srso_alias_return_thunk+0x5/0xfbef5
_raw_spin_lock_irqsave+0x3c/0x60
? ida_free+0xd4/0x2b0
ida_free+0xd4/0x2b0
? __pfx_ida_free+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_locks_remove_file+0x10/0x10
? __fput+0x39f/0xa60
? fput_close_sync+0xff/0x200
? __pfx_fput_close_sync+0x10/0x10
? dnotify_flush+0x22/0x4b0
? __x64_sys_close+0x8c/0xf0
? do_syscall_64+0x115/0x6a0
? entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Modules linked in: snd(O) [last unloaded: snd_timer(O)]
CR2: fffffbfff80480af
---[ end trace 0000000000000000 ]---
Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 69a59b25fe0a80330669a27450ae40deaa5b9084..905176bf6948d790f9cb5732d01d01d858202d1b 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -2173,6 +2173,7 @@ static long snd_utimer_ioctl(struct file *file, unsigned int ioctl, unsigned lon
}
static const struct file_operations snd_utimer_fops = {
+ .owner = THIS_MODULE,
.llseek = noop_llseek,
.release = snd_utimer_release,
.unlocked_ioctl = snd_utimer_ioctl,
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] ALSA: timer: Pin the module for userspace timer controllers
2026-10-11 16:02 [PATCH] ALSA: timer: Pin the module for userspace timer controllers Cen Zhang
@ 2026-10-12 7:25 ` Takashi Iwai
0 siblings, 0 replies; 2+ messages in thread
From: Takashi Iwai @ 2026-10-12 7:25 UTC (permalink / raw)
To: Cen Zhang
Cc: perex, tiwai, norbert, kees+treewide, phucduc.bui,
danishkhateeb03, cassiogabrielcontato, maoyixie.tju,
ivan.orlov0322, linux-sound, linux-kernel, baijiaju1990,
jjzuming
On Sun, 11 Oct 2026 18:02:50 +0200,
Cen Zhang wrote:
>
> The static snd_utimer_ids IDA must remain live until a userspace timer
> controller has returned its ID. However, snd_utimer_fops has no owner,
> so anon_inode_getfd() does not take a reference to snd-timer for the
> controller file.
>
> With CONFIG_SND_TIMER=m and CONFIG_SND_UTIMER=y, userspace can create a
> controller with SNDRV_TIMER_IOCTL_CREATE and close the native timer
> file. If no timer instances or dependent modules retain snd-timer,
> ordinary module unload can then overlap the controller's final release:
>
> Controller final release Module unload
> snd_utimer_release()
> snd_utimer_free()
> snd_timer_free(): unlink provider
> snd_utimer_put_id()
> enter ida_free()
> delete_module()
> alsa_timer_exit()
> free_module(): free MOD_DATA
> access snd_utimer_ids.xa
>
> The provider is already absent from snd_timer_free_all() when unload
> runs. Neither register_mutex nor the IDA's lock keeps module storage
> resident through the remaining IDA access. That access can therefore
> use freed module data and fault while acquiring the XArray lock, as
> shown in the Oops below.
>
> Set snd_utimer_fops.owner to THIS_MODULE so anonymous-file creation
> takes the existing module reference. The VFS drops it only after
> snd_utimer_release() returns, keeping the IDA resident through
> ida_free() and preventing ordinary unload during that interval.
>
> Oops report as below:
>
> BUG: unable to handle page fault for address: fffffbfff80480af
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 1a7ff6067 P4D 1a7ff6067 PUD 1a7ff2067 PMD 100ad6067 PTE 0
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> CPU: 0 UID: 0 PID: 485 Comm: alsa-utimer-fix Tainted: G O 7.2.0-rc6-pmb-bt-functional-v1+ #1 PREEMPT(lazy)
> Tainted: [O]=OOT_MODULE
> Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> RIP: 0010:kasan_byte_accessible+0x15/0x30
> Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 69 f1 2b ff 66 66 2e 0f 1f 84 00 00 00
> RSP: 0018:ffff88811a457c48 EFLAGS: 00010086
> RAX: dffffc0000000000 RBX: ffffffffc0240578 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: ffffffff861f111c RDI: fffffbfff80480af
> RBP: ffffffffc0240578 R08: 0000000000000001 R09: 0000000000000000
> R10: ffffffff891cc057 R11: ffff88811531ba00 R12: ffffffff861f111c
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> FS: 00007ff190ff7780(0000) GS:ffff8881fda2a000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: fffffbfff80480af CR3: 0000000116890003 CR4: 0000000000770ef0
> PKRU: 55555554
> Call Trace:
> <TASK>
> __kasan_check_byte+0x13/0x50
> lock_acquire+0x113/0x2f0
> ? __pfx_pmbd_probe_hit_cookie+0x10/0x10
> ? lock_release+0xc8/0x280
> ? srso_alias_return_thunk+0x5/0xfbef5
> _raw_spin_lock_irqsave+0x3c/0x60
> ? ida_free+0xd4/0x2b0
> ida_free+0xd4/0x2b0
> ? __pfx_ida_free+0x10/0x10
> ? srso_alias_return_thunk+0x5/0xfbef5
> ? __pfx_locks_remove_file+0x10/0x10
> ? __fput+0x39f/0xa60
> ? fput_close_sync+0xff/0x200
> ? __pfx_fput_close_sync+0x10/0x10
> ? dnotify_flush+0x22/0x4b0
> ? __x64_sys_close+0x8c/0xf0
> ? do_syscall_64+0x115/0x6a0
> ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
> </TASK>
> Modules linked in: snd(O) [last unloaded: snd_timer(O)]
> CR2: fffffbfff80480af
> ---[ end trace 0000000000000000 ]---
>
> Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Applied now to for-next branch. Thanks.
Takashi
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-12 7:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-11 16:02 [PATCH] ALSA: timer: Pin the module for userspace timer controllers Cen Zhang
2026-10-12 7:25 ` Takashi Iwai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®