On Tue, 04 Nov 2025 15:11:55 +0100, moonafterrain@outlook.com wrote:

From: Junrui Luo moonafterrain@outlook.com

Clear substream pointers in close functions to prevent use-after-free when timer callbacks or interrupt handlers access them after close.

There can be no actual access done because MPU401_MODE_INPUT_TRIGGER is guaranteed to be off before closing the stream. That is, the variable stream is assigned to an old pointer, but it's not accessed. So, this is not really a use-after-free bug, per se.

Other than that, the fix itself looks good. Please resubmit after rephrasing the patch description.

thanks,

Takashi

Reported-by: Yuhao Jiang danisjiang@gmail.com Reported-by: Junrui Luo moonafterrain@outlook.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo moonafterrain@outlook.com

---

sound/isa/wavefront/wavefront_midi.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/sound/isa/wavefront/wavefront_midi.c b/sound/isa/wavefront/wavefront_midi.c index 1250ecba659a..69d87c4cafae 100644 --- a/sound/isa/wavefront/wavefront_midi.c +++ b/sound/isa/wavefront/wavefront_midi.c @@ -278,6 +278,7 @@ static int snd_wavefront_midi_input_close(struct snd_rawmidi_substream *substrea return -EIO; guard(spinlock_irqsave)(&midi->open);

• midi->substream_input[mpu] = NULL; midi->mode[mpu] &= ~MPU401_MODE_INPUT;

return 0; @@ -300,6 +301,7 @@ static int snd_wavefront_midi_output_close(struct snd_rawmidi_substream *substre return -EIO; guard(spinlock_irqsave)(&midi->open);

• midi->substream_output[mpu] = NULL; midi->mode[mpu] &= ~MPU401_MODE_OUTPUT; return 0;

}

2.51.1.dirty