From nobody Tue Jun 16 10:00:51 2026 Received: from mail-dy1-f180.google.com (mail-dy1-f180.google.com [74.125.82.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E966D31F987 for ; Fri, 17 Apr 2026 20:30:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776457829; cv=none; b=GpAP+2p2zMjUxwy4VkhKdK6j2A50BZRy/U5a/q6PZGqYqshE3q7d+VNX6coMAFROM9J/YueaWXvAh22ovjHNQ0/NKL6gXAtruiNkDUHkvHdk+p+R6jBxGn67k/vCvOf5BVLMFzylZSVOcBqDGah1OMOor3kXLIwNC2OLPUdStRE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776457829; c=relaxed/simple; bh=5sTObtWVavIsLnoazVn7kvfECAUQqVeFO0fIJkuv+e8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=B/KF947DUiu+TQXqqhJUIeG2vG2K53IhTRNSpDrHjCWAL91nIvYs89oeTgJ9u4553auoHABlqj0OsJv4fFze0FllW4clP+ENGoq9mZkHTeY6FGqHQYVTgZBqswDyloGKGZQzHPjYRYHkhtO36PlKoGDujvbduQ29S72VqBJSG6Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=FFeprpc6; arc=none smtp.client-ip=74.125.82.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FFeprpc6" Received: by mail-dy1-f180.google.com with SMTP id 5a478bee46e88-2b4520f6b32so1443384eec.0 for ; Fri, 17 Apr 2026 13:30:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776457827; x=1777062627; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=BQajjHfEzxE/WYi+VB0RvtKv49hMc9n/E/8YFXOSDFo=; b=FFeprpc6sz0J7d0UrvsZELpq/rJqIag61PiIYBzwDy1EwXpc5ZijSEkCqiR6DqhANl Y3955a0VL30LU//iwOCscv8nU9Wt1RYWw5oIXCXG0r7g+Zf5QOWh7fxEcQ/LSVnL+0S4 2y7xXC/QmUOfMnqv7geoqH5fdMxo+SEzzVV25QeoNNOZXr06+9k22Bl4W+WJ5oEBbKaL Q5DaA8f+FXIXnRdfEpZVTMjQcyfLixdk61c4LsP77D9Up8HcYGqBSPHxffmGDwZVJA2h AntGXk1iRcZeGkMLSfKpdJQVwcj/W1iiZREVbsD+kpuAkA29fi/IjWexaJmnKOvmbziF LMWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776457827; x=1777062627; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=BQajjHfEzxE/WYi+VB0RvtKv49hMc9n/E/8YFXOSDFo=; b=lXvin9YCRj7IoqWUvQjaVPG/N4OUsms7AvcuzcqArd+Cvxe0m3pq00GLbxHMc6wamd RY63aabsemjpSz1ueUXfwKabaH7RNnC6YZCdElCiQR/0lO0txhnu6+3kBWyc6PQwtCMV xb2GEJ96QrguCjchBmUSFWU28+X4dtIRpBi1lUl8XfyG8N1kC2d95Vpx0zilQHL484oC aOkHcK0wSchMHMGI7uGlMT8JCi6j0cG/BdoMs5HHxaSNI9ITqQzVsO/235v395qSoTPl 0tAPlMhM9JmAHyMHuHXkIJ2wYRY6xeOuJUY4rqMKtv1eSUCm3QCpaOjmN0SglDeyvvpJ 7wTg== X-Forwarded-Encrypted: i=1; AFNElJ+gKhJsK4kBmbx7jMfLT1IxNGojiQj7nnLVgDMFtU2K7w/klbZlLz/H3JSwU5U8VTZILsGPTudw5GJJgQo=@vger.kernel.org X-Gm-Message-State: AOJu0YxTwqpXjNISLoKx+P6LequfHWyqPi+CKafa7pszLt/bWN8GuIYP p/r5F5t+XJgzibWO49ZUDn0mh8OQMLBU0ehae0BaMNemV2U587ptSIK8 X-Gm-Gg: AeBDieteHYpKngSEC7dijVMhS4E3iN0p3JpoxeVHOZZ7z5ilTbLypBVtkNQiWWBhoy3 c5WfTaSKe+DGH8qwXIxY5H0Np2nhj3002HaLRYL6QF8NNcTVg30z34qE6EHNYV5kGfDmrTQkfX3 ZHhwe58t6riSde07Gzn0qa7x/sXQjTHSpmlz5oylXfa0Ex1+XLNtkEa82+mXcVfM99PNHHQUGY4 Ita9D37h3MaKYuv2yqI3GqhgIv2ACNoxCP052i7lIR14DI6+DGX254TG9z+RNAVFkG8K0LxXGO4 54dkZUgvnLWDr9NJKGtNPcJEVAlgNsTJ/9p5wkC/7F6l+6kpF2o6XxrYzVzjrYYigd7/YCxNFii ZFoMnt99ABFRtPEtlT2tst+YxI0w1UtUyoY+qgZxSEPVLzFxmRIx2C1z5Ro00LaCxrTLUBDHslS dOjnLoEARBR2fGkH/+mCeMRViNHj7O6ydw85fLqZA8SBCjpQBy/iThjERGh3DQvtJUt8yoKh/3i 4vpdlkv6I6ybraGLNDSyfbXMg== X-Received: by 2002:a05:693c:3108:b0:2d8:df01:d9f6 with SMTP id 5a478bee46e88-2e478c20551mr2158027eec.23.1776457826554; Fri, 17 Apr 2026 13:30:26 -0700 (PDT) Received: from [192.168.1.18] (177-4-160-195.user3p.v-tal.net.br. [177.4.160.195]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2e53d9b0b64sm3603666eec.30.2026.04.17.13.30.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Apr 2026 13:30:25 -0700 (PDT) From: =?utf-8?q?C=C3=A1ssio_Gabriel?= Date: Fri, 17 Apr 2026 17:30:18 -0300 Subject: [PATCH] ALSA: als4000: Fix capture trigger chip->mode race Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260417-als4000-capture-trigger-race-v1-1-daeffc2feb67@gmail.com> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/yXMwQrCMAwA0F8ZORvo6hjir4iHNEtrROZIOhHG/ t2qx3d5G7iYisO528Dkpa7PuaE/dMA3mougTs0QQxzD0I9IDx9CCMi01NUEq2kpYmjEgsynFFO ejpwJWrGYZH3/+sv1b1/TXbh+T9j3D533mMyAAAAA X-Change-ID: 20260416-als4000-capture-trigger-race-cc8b2bfd3cfa To: Takashi Iwai , Jaroslav Kysela Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org, =?utf-8?q?C=C3=A1ssio_Gabriel?= X-Mailer: b4 0.15.1 X-Developer-Signature: v=1; a=openpgp-sha256; l=3094; i=cassiogabrielcontato@gmail.com; h=from:subject:message-id; bh=5sTObtWVavIsLnoazVn7kvfECAUQqVeFO0fIJkuv+e8=; b=owGbwMvMwCV2IdZeKur/u2bG02pJDJmPZsTP2u4X5VLONs/4andxd1HhI4879227K+IsAhrY9 /3f+s23o5SFQYyLQVZMkWV10iLLPV0PrtbHrfCAmcPKBDKEgYtTACYycyEjw/c1AuYJbe43bRO4 us5ujdunvl/MZuYbpXmTqlaqSnLO+Mrwm3VJ2OUEwffhe9s5GPx/Rs3iu5Txb8NiholWp0XETfb k8QEA X-Developer-Key: i=cassiogabrielcontato@gmail.com; a=openpgp; fpr=AB62A239BC8AE0D57F5EA848D05D3F1A5AFFEE83 snd_als4000_capture_trigger() updates chip->mode under mixer_lock, while snd_als4000_set_rate() and snd_als4000_playback_trigger() serialize the same rate-lock state with reg_lock. The PCM core serializes callbacks only per acted-on substream, or for an explicitly linked group, so unlinked playback and capture streams can run concurrently. That leaves two races on ALS4000 rate-lock state: - playback and capture trigger callbacks can concurrently update chip->mode and lose one of the SB_RATE_LOCK bits - snd_als4000_set_rate() can observe chip->mode without the capture lock bit set and reprogram the shared sample rate while capture is being started Fix this by taking reg_lock as the outer lock in snd_als4000_capture_trigger() and nesting mixer_lock only for the CR1E write. This keeps chip->mode serialized with the rest of the ALS4000 rate-lock users while preserving the existing CR1E programming sequence. Signed-off-by: C=C3=A1ssio Gabriel --- sound/pci/als4000.c | 44 ++++++++++++++++++++------------------------ 1 file changed, 20 insertions(+), 24 deletions(-) diff --git a/sound/pci/als4000.c b/sound/pci/als4000.c index 33034e07b3d6..636f309c9424 100644 --- a/sound/pci/als4000.c +++ b/sound/pci/als4000.c @@ -421,30 +421,26 @@ static int snd_als4000_capture_trigger(struct snd_pcm= _substream *substream, int { struct snd_sb *chip =3D snd_pcm_substream_chip(substream); int result =3D 0; -=09 - /* FIXME race condition in here!!! - chip->mode non-atomic update gets consistently protected - by reg_lock always, _except_ for this place!! - Probably need to take reg_lock as outer (or inner??) lock, too. - (or serialize both lock operations? probably not, though... - racy?) - */ - guard(spinlock)(&chip->mixer_lock); - switch (cmd) { - case SNDRV_PCM_TRIGGER_START: - case SNDRV_PCM_TRIGGER_RESUME: - chip->mode |=3D SB_RATE_LOCK_CAPTURE; - snd_als4_cr_write(chip, ALS4K_CR1E_FIFO2_CONTROL, - capture_cmd(chip)); - break; - case SNDRV_PCM_TRIGGER_STOP: - case SNDRV_PCM_TRIGGER_SUSPEND: - chip->mode &=3D ~SB_RATE_LOCK_CAPTURE; - snd_als4_cr_write(chip, ALS4K_CR1E_FIFO2_CONTROL, - capture_cmd(chip)); - break; - default: - result =3D -EINVAL; - break; + + guard(spinlock)(&chip->reg_lock); + scoped_guard(spinlock, &chip->mixer_lock) { + switch (cmd) { + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + chip->mode |=3D SB_RATE_LOCK_CAPTURE; + snd_als4_cr_write(chip, ALS4K_CR1E_FIFO2_CONTROL, + capture_cmd(chip)); + break; + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_SUSPEND: + chip->mode &=3D ~SB_RATE_LOCK_CAPTURE; + snd_als4_cr_write(chip, ALS4K_CR1E_FIFO2_CONTROL, + capture_cmd(chip)); + break; + default: + result =3D -EINVAL; + break; + } } return result; } --- base-commit: 99c71f13f9841f8c67fa7595bf0834d3045f5d24 change-id: 20260416-als4000-capture-trigger-race-cc8b2bfd3cfa Best regards, -- =20 C=C3=A1ssio Gabriel