From a6913835735469751f56473f5212eb291a4805e7 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Wed, 7 Oct 2026 19:20:44 +0200 Subject: [PATCH] ALSA: core: Add missing barriers for power_ref vs card->shutdown snd_power_ref_and_wait() increments card->power_ref and then reads card->shutdown (and the power state) locklessly, while snd_card_disconnect() sets card->shutdown and then waits for power_ref to drop to zero via snd_power_sync_ref(). Due to the missing barrier on both sides, the caller proceeds with shutdown still seen as false, while the disconnect side sees a zero refcount and continues tearing down incorrectly. For addressing the potential race, add smp_mb__after_atomic() after the refcount increment and smp_mb() before snd_power_sync_ref() in snd_card_disconnect(). Fixes: e94fdbd7b25d ("ALSA: control: Track in-flight control read/write/tlv accesses") Reported-by: Sashiko Assisted-by: LLM Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20261007172051.13240-9-tiwai@suse.de --- sound/core/init.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/init.c b/sound/core/init.c index 7878c0e6103c..dbe2acfa59fe 100644 --- a/sound/core/init.c +++ b/sound/core/init.c @@ -535,6 +535,8 @@ void snd_card_disconnect(struct snd_card *card) clear_bit(card->number, snd_cards_lock); } + /* order card->shutdown store against power_ref read */ + smp_mb(); snd_power_sync_ref(card); } EXPORT_SYMBOL(snd_card_disconnect); @@ -1152,6 +1154,8 @@ EXPORT_SYMBOL(snd_card_file_remove); int snd_power_ref_and_wait(struct snd_card *card) { snd_power_ref(card); + /* order power_ref increment against card->shutdown read */ + smp_mb__after_atomic(); if (snd_power_get_state(card) != SNDRV_CTL_POWER_D0) { wait_event_cmd(card->power_sleep, card->shutdown ||