Re: [PATCH] ALSA: pcm: Remove channel-map controls before freeing substreams

[Takashi Iwai]

On Mon, 19 Oct 2026 12:01:46 +0200,
Cen Zhang wrote:
> 
> A late HDA codec bind on an already registered card builds new PCMs
> before registering them. add_std_chmaps() publishes generic channel-map
> controls during this BUILD stage. If an earlier chmap succeeds and a
> later allocation fails, probe cleanup frees the BUILD PCM while the
> card's control device remains accessible.
> 
> These generic controls are added directly by snd_pcm_add_chmap_ctls();
> snd_hda_ctls_clear() only removes codec-tracked mixer controls. BUILD
> devices also skip dev_disconnect. snd_pcm_free_stream() then frees the
> substreams before free_chmap() withdraws their generic control:
> 
>   Late HDA codec bind / rollback        Control GET on the live card
>   ------------------------------       ----------------------------
>   hda_codec_driver_probe()
>     snd_hda_codec_build_pcms()
>       PCM is BUILD
>     snd_hda_codec_build_controls()
>       add_std_chmaps()
>         publish an earlier chmap
>         later allocation: -ENOMEM
>     snd_hda_codec_cleanup_for_unbind()
>       snd_hda_ctls_clear()
>         generic chmap remains
>       codec_release_pcms()
>         snd_device_free()
>           BUILD: skip dev_disconnect
>           snd_pcm_free_stream()
>             kfree(substream)
>                                        snd_ctl_elem_read()
>                                          down_read(controls_rwsem)
>                                          pcm_chmap_ctl_get()
>                                            walk freed substream
>             free_chmap()
>               snd_ctl_remove()
>                 wait for GET
>                                          up_read(controls_rwsem)
> 
> The control read lock cannot protect a substream already freed before
> control removal starts. The failure above occurs before
> snd_card_register(), so the PCM has not transitioned out of BUILD.
> 
> Move free_chmap() before the substream free loop. Its snd_ctl_remove()
> withdraws the control and drains readers under controls_rwsem before any
> substream is released. Normal registered-device disconnect already
> removes the control, so the later call remains harmless on that path.
> 
> Fixes: 2d3391ec0ecc ("ALSA: PCM: channel mapping API implementation")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>

Applied now.  Thanks.


Takashi