Re: [PATCH] ALSA: aloop: Keep shared timer callbacks alive through close

[Takashi Iwai]

On Mon, 19 Oct 2026 11:05:21 +0200,
Cen Zhang wrote:
> 
> The shared sound-timer callback must finish using the selected PCM
> runtimes before a close can detach them. loopback_snd_timer_period_elapsed()
> saves the active substreams under cable->lock, then drops the lock before
> calling snd_pcm_period_elapsed() or snd_pcm_stop_xrun(). The sound-timer
> backend has no per-stream close drain, and free_cable() keeps the timer
> open when the paired endpoint remains attached.
> 
> With both directions running on a shared sound timer, playback can be
> dropped and closed while a notification is pending. Capture keeps the
> timer alive, allowing this order:
> 
>   Timer callback                       Playback owner
>   --------------                       --------------
>   select playback under cable->lock
>   unlock; delay notification
>                                        DROP; HW_FREE -> OPEN
>                                        close: snd_pcm_drop(); unlock
>                                        free_cable(); peer stays alive
>   snd_pcm_period_elapsed()
>     lock stream; cache runtime
>                                        snd_pcm_detach_substream()
>                                          free runtime and its fasync
>     read runtime->fasync
> 
> The stream lock taken by snd_pcm_drop() cannot protect a notification
> that starts after it returns, and detach does not take it. The callback
> can therefore read runtime->fasync after the runtime has been freed, and
> an escaped notification can also reach a replacement runtime if the same
> substream slot is reopened before the notification resumes.
> 
> Take the existing cable->stop_count reference under cable->lock when
> selecting the targets and release it after the PCM callbacks finish,
> including the XRUN path. free_cable() already removes the closing
> endpoint under that lock and waits for stop_count before returning, so
> runtime detach and slot reuse cannot overtake the notification.
> 
> Fixes: 26c53379f98d ("ALSA: aloop: Support selection of snd_timer instead of jiffies")
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>
> Assisted-by: LLM

Applied now.  Thanks.


Takashi