CVE-2026-74387: ALSA: seq: midi: Serialize output teardown with event_input

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: midi: Serialize output teardown with eventinput

eventprocessmidi() borrows msynth->outputrfile.output and then passes the substream to dumpmidi() and sndrawmidikernelwrite() without synchronizing with the output open/close transition. midisynthuse() also publishes outputrfile before sndrawmidioutputparams() has finished.

The last midisynthunuse() can therefore release the same rawmidi file and free substream->runtime before sndrawmidikernelwrite1() takes its runtime buffer reference. That leaves the eventinput path using a stale substream or runtime and can end in a NULL-deref or use-after-free.

Fix this with two pieces of synchronization. Keep a short IRQ-safe spinlock only for publishing or clearing outputrfile and for pairing the output snapshot with an snduselockt reference. Once eventprocessmidi() has taken that in-flight reference, it drops the spinlock before calling sndseqdumpvarevent(), dumpmidi(), or sndrawmidikernelwrite(). midisynthunuse() now detaches the visible rawmidi file under the same spinlock, waits for the in-flight writers to drain, and only then drains and releases the saved file. midisynthuse() likewise opens into a local sndrawmidifile and publishes it only after sndrawmidioutputparams() succeeds.

The buggy scenario involves two paths, with each column showing the order within that path:

eventinput path: last unuse path: 1. eventprocessmidi() snapshots 1. midisynthunuse() starts outputrfile.output. tearing down outputrfile. 2. dumpmidi() reaches 2. sndrawmidikernelrelease() sndrawmidikernelwrite() closes the output file. before runtime is pinned. 3. closesubstream() frees 3. The callback keeps using substream->runtime. the borrowed substream.

Validation reproduced this kernel report: KASAN null-ptr-deref in sndrawmidikernelwrite1+0x56/0x360 RIP: 0033:0x7fde7dd0837f RIP: 0010:sndrawmidikernelwrite1+0x56/0x360