[PATCH] ALSA: aloop: Fix spinlock deadlock in loopback_hrtimer_stop()

[Yu-Hsuan Hsu]

In loopback_hrtimer_stop(), calling hrtimer_cancel() while holding
cable->lock triggers an AB-BA spinlock deadlock if the hrtimer softirq
is executing concurrently on another CPU:

1) CPU A runs loopback_trigger(STOP), acquires spin_lock(&cable->lock),
   and calls hrtimer_cancel(). Since hrtimer_cancel() is synchronous,
   it spins waiting for the executing callback to complete before
   returning.
2) CPU B executes loopback_hrtimer_function(), which immediately tries
   to acquire spin_lock(&cable->lock).

This mutual dependency leads to a CPU hard lockup and NMI watchdog
panic when multiple streams start and stop concurrently with small
period sizes.

Replace hrtimer_cancel() in loopback_hrtimer_stop() with the non-blocking
hrtimer_try_to_cancel(), matching the behavior of jiffies timers
(timer_delete vs timer_delete_sync). If try_to_cancel returns -1
because the handler is running, CPU A releases cable->lock cleanly.
When the running handler subsequently acquires cable->lock, it observes
that the stream is no longer in running state (cleared by trigger STOP)
and terminates without re-arming the timer. Synchronous hrtimer_cancel()
remains preserved in loopback_hrtimer_stop_sync() where cable->lock is
not held.

Fixes: bf08a5f698dc ("ALSA: aloop: Add 'hrtimer' option to timer_source")
Signed-off-by: Yu-Hsuan Hsu <yuhsuan@xxxxxxxxxxxx>
---
 sound/drivers/aloop.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index 236f49a7fb8b..60f5bf1e48bb 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -303,7 +303,7 @@ static inline int loopback_jiffies_timer_stop(struct loopback_pcm *dpcm)
 /* call in cable->lock */
 static inline int loopback_hrtimer_stop(struct loopback_pcm *dpcm)
 {
-	hrtimer_cancel(&dpcm->hrtimer);
+	hrtimer_try_to_cancel(&dpcm->hrtimer);
 
 	return 0;
 }
-- 
2.55.0.508.g3f0d502094-goog