Re: [PATCH v3 1/2] ALSA: pcm: Protect the unregister notifier traversal

[Takashi Iwai]

On Sun, 18 Oct 2026 16:07:26 +0200,
Cen Zhang wrote:
> 
> snd_pcm_free() traverses snd_pcm_notify_list and calls n_unregister
> without register_mutex, although snd_pcm_notify() takes that mutex to
> add and remove notifiers. PCM disconnect releases the mutex before the
> free callback runs, so it does not protect this later traversal.
> 
> With no open OSS file, normal snd-pcm-oss removal can overlap PCM card
> teardown, for example when unbinding snd-dummy:
> 
>   PCM card teardown                     snd-pcm-oss unload
>   -----------------                     ------------------
>   snd_pcm_dev_disconnect()
>     remove PCM under register_mutex
>     unlock register_mutex
>   snd_pcm_free()
>     fetch notifier
>                                         snd_pcm_notify(..., 1)
>                                           unlink notifier under mutex
>                                         free module storage
>     read notifier->n_unregister
>     invoke callback
> 
> The free path can then read the notifier from released module storage
> or call its unloaded code.
> 
> Hold register_mutex across the unregister traversal and its callbacks.
> Notifier removal must wait until both have finished. This also protects
> the traversal if a callback releases the last module reference: module
> exit cannot unlink its notifier until the free path releases the mutex.
> Drop the mutex before private_free and the remaining stream cleanup.
> 
> Fixes: c461482c8072 ("[ALSA] Unregister device files at disconnection")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>

Applied both patches to for-next branch now.  Thanks.


Takashi