From: Takashi Iwai <tiwai@xxxxxxx> commit 3c3201f8c7bb77eb53b08a3ca8d9a4ddc500b4c0 upstream. Like the previous fixes to hw_params and hw_free ioctl races, we need to paper over the concurrent prepare ioctl calls against hw_params and hw_free, too. This patch implements the locking with the existing runtime->buffer_mutex for prepare ioctls. Unlike the previous case for snd_pcm_hw_hw_params() and snd_pcm_hw_free(), snd_pcm_prepare() is performed to the linked streams, hence the lock can't be applied simply on the top. For tracking the lock in each linked substream, we modify snd_pcm_action_group() slightly and apply the buffer_mutex for the case stream_lock=false (formerly there was no lock applied) there. Cc: <stable@xxxxxxxxxxxxxxx> Reviewed-by: Jaroslav Kysela <perex@xxxxxxxx> Link: https://lore.kernel.org/r/20220322170720.3529-4-tiwai@xxxxxxx Signed-off-by: Takashi Iwai <tiwai@xxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- sound/core/pcm_native.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -1171,15 +1171,17 @@ struct action_ops { static int snd_pcm_action_group(const struct action_ops *ops, struct snd_pcm_substream *substream, snd_pcm_state_t state, - bool do_lock) + bool stream_lock) { struct snd_pcm_substream *s = NULL; struct snd_pcm_substream *s1; int res = 0, depth = 1; snd_pcm_group_for_each_entry(s, substream) { - if (do_lock && s != substream) { - if (s->pcm->nonatomic) + if (s != substream) { + if (!stream_lock) + mutex_lock_nested(&s->runtime->buffer_mutex, depth); + else if (s->pcm->nonatomic) mutex_lock_nested(&s->self_group.mutex, depth); else spin_lock_nested(&s->self_group.lock, depth); @@ -1207,18 +1209,18 @@ static int snd_pcm_action_group(const st ops->post_action(s, state); } _unlock: - if (do_lock) { - /* unlock streams */ - snd_pcm_group_for_each_entry(s1, substream) { - if (s1 != substream) { - if (s1->pcm->nonatomic) - mutex_unlock(&s1->self_group.mutex); - else - spin_unlock(&s1->self_group.lock); - } - if (s1 == s) /* end */ - break; + /* unlock streams */ + snd_pcm_group_for_each_entry(s1, substream) { + if (s1 != substream) { + if (!stream_lock) + mutex_unlock(&s1->runtime->buffer_mutex); + else if (s1->pcm->nonatomic) + mutex_unlock(&s1->self_group.mutex); + else + spin_unlock(&s1->self_group.lock); } + if (s1 == s) /* end */ + break; } return res; } @@ -1348,10 +1350,12 @@ static int snd_pcm_action_nonatomic(cons /* Guarantee the group members won't change during non-atomic action */ down_read(&snd_pcm_link_rwsem); + mutex_lock(&substream->runtime->buffer_mutex); if (snd_pcm_stream_linked(substream)) res = snd_pcm_action_group(ops, substream, state, false); else res = snd_pcm_action_single(ops, substream, state); + mutex_unlock(&substream->runtime->buffer_mutex); up_read(&snd_pcm_link_rwsem); return res; } Patches currently in stable-queue which might be from tiwai@xxxxxxx are queue-5.10/alsa-pcm-fix-races-among-concurrent-prepare-and-hw_params-hw_free-calls.patch queue-5.10/alsa-hda-realtek-add-quirk-for-clevo-np70pnj.patch queue-5.10/alsa-hda-realtek-add-quirk-for-asus-ga402.patch queue-5.10/alsa-cmipci-restore-aux-vol-on-suspend-resume.patch queue-5.10/alsa-pcm-fix-races-among-concurrent-prealloc-proc-writes.patch queue-5.10/asoc-sti-fix-deadlock-via-snd_pcm_stop_xrun-call.patch queue-5.10/alsa-usb-audio-add-mute-tlv-for-playback-volumes-on-rode-nt-usb.patch queue-5.10/alsa-oss-fix-pcm-oss-buffer-allocation-overflow.patch queue-5.10/alsa-pci-fix-reading-of-swapped-values-from-pcmreg-in-ac97-codec.patch queue-5.10/alsa-usb-audio-add-mapping-for-new-corsair-virtuoso-se.patch queue-5.10/alsa-hda-realtek-add-quirk-for-clevo-np50pnj.patch queue-5.10/alsa-pcm-fix-races-among-concurrent-hw_params-and-hw_free-calls.patch queue-5.10/alsa-pcm-add-stream-lock-during-pcm-reset-ioctl-operations.patch queue-5.10/alsa-pcm-fix-races-among-concurrent-read-write-and-buffer-changes.patch queue-5.10/alsa-hda-realtek-fix-headset-mic-problem-for-a-hp-machine-with-alc671.patch