ALSA: usb-audio: Guard FCP protocol transfers

FCP meter and hwdep operations issue control transfers without
preventing runtime suspend or disconnect. Protect the central
request-and-response transport. One reference then covers the command,
acknowledgment wait, and response.

The initial step-zero request bypasses that transport. Hold an outer
reference across the complete initialization sequence so the device stays
active through step zero, notification-URB setup, and both initialization
commands. The central transport keeps its guard for calls outside
initialization; the existing active counter balances the nested calls.

FCP has no private resume callback. Its suspend callback only removes the
notification URB. Taking the initialization and transport guards under the
existing protocol mutex causes no resume-side lock inversion.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Will Porter <mrwillporter@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260827232143.149197-7-mrwillporter@gmail.com
This commit is contained in:
Will Porter 2026-08-27 18:21:43 -05:00 committed by Takashi Iwai
parent 9d4ae593fc
commit d476d5995c

View File

@ -191,6 +191,10 @@ static int fcp_usb(struct usb_mixer_interface *mixer, u32 opcode,
const int max_retries = 5;
int err;
CLASS(snd_usb_lock, pm)(mixer->chip);
if (pm.err < 0)
return -EIO;
if (!private->urb)
return -ENODEV;
@ -1026,6 +1030,10 @@ static int fcp_init(struct usb_mixer_interface *mixer,
struct usb_device *dev = mixer->chip->dev;
int err;
CLASS(snd_usb_lock, pm)(mixer->chip);
if (pm.err < 0)
return -EIO;
err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0),
FCP_USB_REQ_STEP0,
USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_IN,