github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-09 13:44:03 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ALSA: core: Add missing barriers for power_ref vs card->shutdown

Browse Source 
snd_power_ref_and_wait() increments card->power_ref and then reads
card->shutdown (and the power state) locklessly, while
snd_card_disconnect() sets card->shutdown and then waits for
power_ref to drop to zero via snd_power_sync_ref().  Due to the
missing barrier on both sides, the caller proceeds with shutdown still
seen as false, while the disconnect side sees a zero refcount and
continues tearing down incorrectly.

For addressing the potential race, add smp_mb__after_atomic() after
the refcount increment and smp_mb() before snd_power_sync_ref() in
snd_card_disconnect().

Fixes: e94fdbd7b2 ("ALSA: control: Track in-flight control read/write/tlv accesses")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Assisted-by: LLM
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20261007172051.13240-9-tiwai@suse.de
This commit is contained in:
Takashi Iwai 2026-10-07 19:20:44 +02:00
parent f224bd39d2
commit a691383573
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sound/core/init.c
View File

@ -535,6 +535,8 @@ void snd_card_disconnect(struct snd_card *card)
clear_bit(card->number, snd_cards_lock);
}
/* order card->shutdown store against power_ref read */
smp_mb();
snd_power_sync_ref(card);
}
EXPORT_SYMBOL(snd_card_disconnect);
@ -1152,6 +1154,8 @@ EXPORT_SYMBOL(snd_card_file_remove);
int snd_power_ref_and_wait(struct snd_card *card)
{
snd_power_ref(card);
/* order power_ref increment against card->shutdown read */
smp_mb__after_atomic();
if (snd_power_get_state(card) != SNDRV_CTL_POWER_D0) {
wait_event_cmd(card->power_sleep,
card->shutdown ||