[PATCH] ALSA: timer: Pin the module for userspace timer controllers

[Cen Zhang <zzzccc427@gmail.com>]

The static snd_utimer_ids IDA must remain live until a userspace timer
controller has returned its ID. However, snd_utimer_fops has no owner,
so anon_inode_getfd() does not take a reference to snd-timer for the
controller file.

With CONFIG_SND_TIMER=m and CONFIG_SND_UTIMER=y, userspace can create a
controller with SNDRV_TIMER_IOCTL_CREATE and close the native timer
file. If no timer instances or dependent modules retain snd-timer,
ordinary module unload can then overlap the controller's final release:

  Controller final release              Module unload
  snd_utimer_release()
    snd_utimer_free()
      snd_timer_free(): unlink provider
      snd_utimer_put_id()
        enter ida_free()
                                        delete_module()
                                          alsa_timer_exit()
                                          free_module(): free MOD_DATA
        access snd_utimer_ids.xa

The provider is already absent from snd_timer_free_all() when unload
runs. Neither register_mutex nor the IDA's lock keeps module storage
resident through the remaining IDA access. That access can therefore
use freed module data and fault while acquiring the XArray lock, as
shown in the Oops below.

Set snd_utimer_fops.owner to THIS_MODULE so anonymous-file creation
takes the existing module reference. The VFS drops it only after
snd_utimer_release() returns, keeping the IDA resident through
ida_free() and preventing ordinary unload during that interval.

Oops report as below:

    BUG: unable to handle page fault for address: fffffbfff80480af
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    PGD 1a7ff6067 P4D 1a7ff6067 PUD 1a7ff2067 PMD 100ad6067 PTE 0
    Oops: Oops: 0000 [#1] SMP KASAN NOPTI
    CPU: 0 UID: 0 PID: 485 Comm: alsa-utimer-fix Tainted: G           O        7.2.0-rc6-pmb-bt-functional-v1+ #1 PREEMPT(lazy)
    Tainted: [O]=OOT_MODULE
    Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    RIP: 0010:kasan_byte_accessible+0x15/0x30
    Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 69 f1 2b ff 66 66 2e 0f 1f 84 00 00 00
    RSP: 0018:ffff88811a457c48 EFLAGS: 00010086
    RAX: dffffc0000000000 RBX: ffffffffc0240578 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: ffffffff861f111c RDI: fffffbfff80480af
    RBP: ffffffffc0240578 R08: 0000000000000001 R09: 0000000000000000
    R10: ffffffff891cc057 R11: ffff88811531ba00 R12: ffffffff861f111c
    R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
    FS:  00007ff190ff7780(0000) GS:ffff8881fda2a000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: fffffbfff80480af CR3: 0000000116890003 CR4: 0000000000770ef0
    PKRU: 55555554
    Call Trace:
     <TASK>
     __kasan_check_byte+0x13/0x50
     lock_acquire+0x113/0x2f0
     ? __pfx_pmbd_probe_hit_cookie+0x10/0x10
     ? lock_release+0xc8/0x280
     ? srso_alias_return_thunk+0x5/0xfbef5
     _raw_spin_lock_irqsave+0x3c/0x60
     ? ida_free+0xd4/0x2b0
     ida_free+0xd4/0x2b0
     ? __pfx_ida_free+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_locks_remove_file+0x10/0x10
     ? __fput+0x39f/0xa60
     ? fput_close_sync+0xff/0x200
     ? __pfx_fput_close_sync+0x10/0x10
     ? dnotify_flush+0x22/0x4b0
     ? __x64_sys_close+0x8c/0xf0
     ? do_syscall_64+0x115/0x6a0
     ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
     </TASK>
    Modules linked in: snd(O) [last unloaded: snd_timer(O)]
    CR2: fffffbfff80480af
    ---[ end trace 0000000000000000 ]---

Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---

diff --git a/sound/core/timer.c b/sound/core/timer.c
index 69a59b25fe0a80330669a27450ae40deaa5b9084..905176bf6948d790f9cb5732d01d01d858202d1b 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -2173,6 +2173,7 @@ static long snd_utimer_ioctl(struct file *file, unsigned int ioctl, unsigned lon
 }
 
 static const struct file_operations snd_utimer_fops = {
+	.owner		=	THIS_MODULE,
 	.llseek		=	noop_llseek,
 	.release	=	snd_utimer_release,
 	.unlocked_ioctl	=	snd_utimer_ioctl,