If the sequencer device outlives the rawmidi device, then snd_rawmidi_dev_seq_free() will run after release_rawmidi_device() has freed the snd_rawmidi structure. This can easily be reproduced with CONFIG_DEBUG_KOBJECT_RELEASE. Keep a reference to the rawmidi device until the sequencer has been destroyed in order to avoid this. Signed-off-by: John Keeping <john@xxxxxxxxxxxx> --- sound/core/rawmidi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c index 6f30231bdb88..b015f5f69175 100644 --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@ -1860,6 +1860,7 @@ static void snd_rawmidi_dev_seq_free(struct snd_seq_device *device) struct snd_rawmidi *rmidi = device->private_data; rmidi->seq_dev = NULL; + put_device(&rmidi->dev); } #endif @@ -1936,6 +1937,9 @@ static int snd_rawmidi_dev_register(struct snd_device *device) #if IS_ENABLED(CONFIG_SND_SEQUENCER) if (!rmidi->ops || !rmidi->ops->dev_register) { /* own registration mechanism */ if (snd_seq_device_new(rmidi->card, rmidi->device, SNDRV_SEQ_DEV_ID_MIDISYNTH, 0, &rmidi->seq_dev) >= 0) { + /* Ensure we outlive the sequencer (see snd_rawmidi_dev_seq_free). */ + get_device(&rmidi->dev); + rmidi->seq_dev->private_data = rmidi; rmidi->seq_dev->private_free = snd_rawmidi_dev_seq_free; sprintf(rmidi->seq_dev->name, "MIDI %d-%d", rmidi->card->number, rmidi->device); -- 2.33.0