[PATCH] ALSA: pcmtest: Pin the module while pattern files are open

[PATCH] ALSA: pcmtest: Pin the module while pattern files are open

[Cen Zhang]

The fill_pattern_fops table must remain alive until the final release
of each pattern debugfs file. It has no .owner, so the fops_get() call
in full_proxy_open_regular() does not take a PCMTest module reference.

With snd-pcmtest loaded as a module, a user with permission to open a
fill_patternN file and unload the module can retain the descriptor
across normal unload, provided no PCM file or other module reference
prevents it. The following ordering is possible:

  Pattern file user                   Module unload
  -----------------                   -------------
  open(fill_patternN)
    full_proxy_open_regular()
      fops_get(fill_pattern_fops)
        owner == NULL: no module pin
  keep the descriptor open
                                      mod_exit()
                                        clear_debug_files()
                                          debugfs_remove_recursive()
                                          drain active operations
                                      return from mod_exit()
                                      free_module()
                                        free the module image
  close(fd)
    full_proxy_release()
      read real_fops->release -> UAF
      fops_put(real_fops)
        read real_fops->owner
      access freed module memory

Even though the table has no release callback, reading those fields
is a use-after-free and can fault. The retained dentry keeps the
proxy's bookkeeping alive, but does not retain the module storage.

Set .owner to THIS_MODULE so the existing fops_get()/fops_put() pair
pins PCMTest until final release has finished accessing the table.
Normal module unload is then blocked while any pattern file is open.

Fixes: 315a3d57c64c ("ALSA: Implement the new Virtual PCM Test Driver")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Assisted-by: LLM

---

diff --git a/sound/drivers/pcmtest.c b/sound/drivers/pcmtest.c
index 393f132a438b343c156e4ab45cbce4d4e2230923..d1b0dff56cd9f67b2e32031a1ea62c9a268e5e71 100644
--- a/sound/drivers/pcmtest.c
+++ b/sound/drivers/pcmtest.c
@@ -633,6 +633,7 @@ static ssize_t pattern_read(struct file *file, char __user *u_buff, size_t len,
 }
 
 static const struct file_operations fill_pattern_fops = {
+	.owner = THIS_MODULE,
 	.read = pattern_read,
 	.write = pattern_write,
 };

Re: [PATCH] ALSA: pcmtest: Pin the module while pattern files are open

[Takashi Iwai]

On Mon, 19 Oct 2026 11:04:42 +0200,
Cen Zhang wrote:
> 
> The fill_pattern_fops table must remain alive until the final release
> of each pattern debugfs file. It has no .owner, so the fops_get() call
> in full_proxy_open_regular() does not take a PCMTest module reference.
> 
> With snd-pcmtest loaded as a module, a user with permission to open a
> fill_patternN file and unload the module can retain the descriptor
> across normal unload, provided no PCM file or other module reference
> prevents it. The following ordering is possible:
> 
>   Pattern file user                   Module unload
>   -----------------                   -------------
>   open(fill_patternN)
>     full_proxy_open_regular()
>       fops_get(fill_pattern_fops)
>         owner == NULL: no module pin
>   keep the descriptor open
>                                       mod_exit()
>                                         clear_debug_files()
>                                           debugfs_remove_recursive()
>                                           drain active operations
>                                       return from mod_exit()
>                                       free_module()
>                                         free the module image
>   close(fd)
>     full_proxy_release()
>       read real_fops->release -> UAF
>       fops_put(real_fops)
>         read real_fops->owner
>       access freed module memory
> 
> Even though the table has no release callback, reading those fields
> is a use-after-free and can fault. The retained dentry keeps the
> proxy's bookkeeping alive, but does not retain the module storage.
> 
> Set .owner to THIS_MODULE so the existing fops_get()/fops_put() pair
> pins PCMTest until final release has finished accessing the table.
> Normal module unload is then blocked while any pattern file is open.
> 
> Fixes: 315a3d57c64c ("ALSA: Implement the new Virtual PCM Test Driver")
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
> Assisted-by: LLM

Applied now.  Thanks.


Takashi