[PATCH] ALSA: seq: oss: Initialize the timer before publishing the port

[PATCH] ALSA: seq: oss: Initialize the timer before publishing the port

[Cen Zhang]

An OSS sequencer port must have an initialized timer before MIDI input
can reach send_midi_event(). snd_seq_oss_open() publishes the callback
port and assigns dp->readq before allocating dp->timer.

A client owning a MIDI port that another OSS session has opened for
reading can submit a direct event to the new OSS port. Direct delivery
does not require a subscription to the destination, and
snd_seq_oss_midi_input() checks the source alias's readable-open bit
without requiring that alias to belong to the destination session.
For a read-capable /dev/sequencer open, this permits the following order:

  OSS open                         Direct MIDI input
  create_port(dp)
  dp->readq = ...
                                   snd_seq_write() to the new port
                                   snd_seq_oss_midi_input()
                                   send_midi_event()
                                     dp->timer->running
  dp->timer = snd_seq_oss_timer_new(dp)

The callback dereferences a NULL timer in this interval. The OSS
register_mutex does not cover event callbacks, and the destination
port's use reference only protects the session's lifetime.

Initialize the timer before creating the callback port, so the existing
port publication also publishes the initialized timer. The timer
constructor does not need a queue or a port. Use free_devinfo() when no
port was created to release the timer on failures.

Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Assisted-by: LLM

---

diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
index 6586e07431c35f4fdeb074a65f982e3cc78d0ee5..f1bd52c765b97f54932456f2e68164cb4f02fdc5 100644
--- a/sound/core/seq/oss/seq_oss_init.c
+++ b/sound/core/seq/oss/seq_oss_init.c
@@ -198,6 +198,14 @@ snd_seq_oss_open(struct file *file, int level)
 		goto _error;
 	}
 
+	/* initialize timer before the port can receive events */
+	dp->timer = snd_seq_oss_timer_new(dp);
+	if (!dp->timer) {
+		pr_err("ALSA: seq_oss: can't alloc timer\n");
+		rc = -ENOMEM;
+		goto _error;
+	}
+
 	/* create port */
 	rc = create_port(dp);
 	if (rc < 0) {
@@ -239,14 +247,6 @@ snd_seq_oss_open(struct file *file, int level)
 		}
 	}
 
-	/* initialize timer */
-	dp->timer = snd_seq_oss_timer_new(dp);
-	if (!dp->timer) {
-		pr_err("ALSA: seq_oss: can't alloc timer\n");
-		rc = -ENOMEM;
-		goto _error;
-	}
-
 	/* set private data pointer */
 	file->private_data = dp;
 
@@ -328,7 +328,7 @@ static int
 delete_port(struct seq_oss_devinfo *dp)
 {
 	if (dp->port < 0) {
-		kfree(dp);
+		free_devinfo(dp);
 		return 0;
 	}
 

Re: [PATCH] ALSA: seq: oss: Initialize the timer before publishing the port

[Takashi Iwai]

On Sat, 17 Oct 2026 09:01:49 +0200,
Cen Zhang wrote:
> 
> An OSS sequencer port must have an initialized timer before MIDI input
> can reach send_midi_event(). snd_seq_oss_open() publishes the callback
> port and assigns dp->readq before allocating dp->timer.
> 
> A client owning a MIDI port that another OSS session has opened for
> reading can submit a direct event to the new OSS port. Direct delivery
> does not require a subscription to the destination, and
> snd_seq_oss_midi_input() checks the source alias's readable-open bit
> without requiring that alias to belong to the destination session.
> For a read-capable /dev/sequencer open, this permits the following order:
> 
>   OSS open                         Direct MIDI input
>   create_port(dp)
>   dp->readq = ...
>                                    snd_seq_write() to the new port
>                                    snd_seq_oss_midi_input()
>                                    send_midi_event()
>                                      dp->timer->running
>   dp->timer = snd_seq_oss_timer_new(dp)
> 
> The callback dereferences a NULL timer in this interval. The OSS
> register_mutex does not cover event callbacks, and the destination
> port's use reference only protects the session's lifetime.
> 
> Initialize the timer before creating the callback port, so the existing
> port publication also publishes the initialized timer. The timer
> constructor does not need a queue or a port. Use free_devinfo() when no
> port was created to release the timer on failures.
> 
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
> Assisted-by: LLM

This issue should have been covered by my recent fix:
  https://patch.msgid.link/20261016161930.482309-1-tiwai@suse.de


thanks,

Takashi

Re: [PATCH] ALSA: seq: oss: Initialize the timer before publishing the port

[Cen Zhang]

Hi Takashi,

>
> This issue should have been covered by my recent fix:
>   https://patch.msgid.link/20261016161930.482309-1-tiwai@suse.de
>
>
> thanks,
>
> Takashi

Thanks for the pointer. It did fix this issue.

Best regards,
Cen Zhang