Re: [PATCH] ALSA: mtpav: shut down output timer before card teardown

[Takashi Iwai]

On Thu, 20 Aug 2026 13:27:49 +0200,
Runyu Xiao wrote:
> 
> snd_mtpav_output_timer() rearms chip->timer while holding
> chip->spinlock and accesses the card-private mtpav state.
> 
> snd_mtpav_free() currently takes the same lock and calls
> timer_delete() when the timer is active. This only removes a
> pending timer; it does not wait for a callback that is already
> running and does not prevent the callback from rearming the timer.
> 
> A callback running on another CPU can therefore continue after
> snd_mtpav_free() releases the lock and access the card-private
> state while the card is being torn down. It can also rearm the
> timer after timer_delete() has returned.
> 
> Call timer_shutdown_sync() without holding chip->spinlock. This
> waits for any running callback to finish and prevents further
> rearming before the card-private mtpav state is released.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>

Thanks, applied now.


Takashi