From d5dd05c1f72a95d8ab06828d7272a185ad2b9185 Mon Sep 17 00:00:00 2001 From: Cen Zhang Date: Mon, 19 Oct 2026 18:01:46 +0800 Subject: [PATCH] ALSA: pcm: Remove channel-map controls before freeing substreams A late HDA codec bind on an already registered card builds new PCMs before registering them. add_std_chmaps() publishes generic channel-map controls during this BUILD stage. If an earlier chmap succeeds and a later allocation fails, probe cleanup frees the BUILD PCM while the card's control device remains accessible. These generic controls are added directly by snd_pcm_add_chmap_ctls(); snd_hda_ctls_clear() only removes codec-tracked mixer controls. BUILD devices also skip dev_disconnect. snd_pcm_free_stream() then frees the substreams before free_chmap() withdraws their generic control: Late HDA codec bind / rollback Control GET on the live card ------------------------------ ---------------------------- hda_codec_driver_probe() snd_hda_codec_build_pcms() PCM is BUILD snd_hda_codec_build_controls() add_std_chmaps() publish an earlier chmap later allocation: -ENOMEM snd_hda_codec_cleanup_for_unbind() snd_hda_ctls_clear() generic chmap remains codec_release_pcms() snd_device_free() BUILD: skip dev_disconnect snd_pcm_free_stream() kfree(substream) snd_ctl_elem_read() down_read(controls_rwsem) pcm_chmap_ctl_get() walk freed substream free_chmap() snd_ctl_remove() wait for GET up_read(controls_rwsem) The control read lock cannot protect a substream already freed before control removal starts. The failure above occurs before snd_card_register(), so the PCM has not transitioned out of BUILD. Move free_chmap() before the substream free loop. Its snd_ctl_remove() withdraws the control and drains readers under controls_rwsem before any substream is released. Normal registered-device disconnect already removes the control, so the later call remains harmless on that path. Fixes: 2d3391ec0ecc ("ALSA: PCM: channel mapping API implementation") Assisted-by: LLM Signed-off-by: Cen Zhang Link: https://patch.msgid.link/pm-pmb-4a207d9ef3a3597a74a4-v4-80b0113669b1a62fbbe9@gmail.com Signed-off-by: Takashi Iwai --- sound/core/pcm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/core/pcm.c b/sound/core/pcm.c index 35ece386d1a2..1e4e0ecb3dbd 100644 --- a/sound/core/pcm.c +++ b/sound/core/pcm.c @@ -819,6 +819,9 @@ static void snd_pcm_free_stream(struct snd_pcm_str * pstr) /* free all proc files under the stream */ snd_pcm_stream_proc_done(pstr); + /* Drain channel-map callbacks before freeing the substreams. */ + free_chmap(pstr); + substream = pstr->substream; while (substream) { substream_next = substream->next; @@ -833,7 +836,6 @@ static void snd_pcm_free_stream(struct snd_pcm_str * pstr) kfree(setup); } #endif - free_chmap(pstr); if (pstr->substream_count) put_device(pstr->dev); }