• Takashi Iwai's avatar
    ALSA: usb-audio: fix oops due to cleanup race when disconnecting · 382225e6
    Takashi Iwai authored
    When a USB audio device is disconnected, snd_usb_audio_disconnect()
    kills all audio URBs.  At the same time, the application, after being
    notified of the disconnection, might close the device, in which case
    ALSA calls the .hw_free callback, which should free the URBs too.
    
    Commit de1b8b93 "[ALSA] Fix hang-up at disconnection of usb-audio"
    prevented snd_usb_hw_free() from freeing the URBs to avoid a hang that
    resulted from this race, but this introduced another race because the
    URB callbacks could now be executed after snd_usb_hw_free() has
    returned, and try to access already freed data.
    
    Fix the first race by introducing a mutex to serialize the disconnect
    callback and all PCM callbacks that manage URBs (hw_free and hw_params).
    Reported-and-tested-by: default avatarPierre-Louis Bossart <pierre-louis.bossart@intel.com>
    Cc: <stable@kernel.org>
    [CL: also serialize hw_params callback]
    Signed-off-by: default avatarClemens Ladisch <clemens@ladisch.de>
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    382225e6
card.c 17.8 KB