snd_mtpav_output_timer() rearms chip->timer while holding
chip->spinlock and accesses the card-private mtpav state.

snd_mtpav_free() currently takes the same lock and calls
timer_delete() when the timer is active. This only removes a
pending timer; it does not wait for a callback that is already
running and does not prevent the callback from rearming the timer.

A callback running on another CPU can therefore continue after
snd_mtpav_free() releases the lock and access the card-private
state while the card is being torn down. It can also rearm the
timer after timer_delete() has returned.

Call timer_shutdown_sync() without holding chip->spinlock. This
waits for any running callback to finish and prevents further
rearming before the card-private mtpav state is released.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 sound/drivers/mtpav.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/sound/drivers/mtpav.c b/sound/drivers/mtpav.c
index d31eadf4be5f..1ed6d4f0cb62 100644
--- a/sound/drivers/mtpav.c
+++ b/sound/drivers/mtpav.c
@@ -642,9 +642,7 @@ static void snd_mtpav_free(struct snd_card *card)
 {
 	struct mtpav *crd = card->private_data;
 
-	guard(spinlock_irqsave)(&crd->spinlock);
-	if (crd->istimer > 0)
-		snd_mtpav_remove_output_timer(crd);
+	timer_shutdown_sync(&crd->timer);
 }
 
 /*
-- 
2.34.1

On Thu, 20 Aug 2026 13:27:49 +0200,
Runyu Xiao wrote:
> 
> snd_mtpav_output_timer() rearms chip->timer while holding
> chip->spinlock and accesses the card-private mtpav state.
> 
> snd_mtpav_free() currently takes the same lock and calls
> timer_delete() when the timer is active. This only removes a
> pending timer; it does not wait for a callback that is already
> running and does not prevent the callback from rearming the timer.
> 
> A callback running on another CPU can therefore continue after
> snd_mtpav_free() releases the lock and access the card-private
> state while the card is being torn down. It can also rearm the
> timer after timer_delete() has returned.
> 
> Call timer_shutdown_sync() without holding chip->spinlock. This
> waits for any running callback to finish and prevents further
> rearming before the card-private mtpav state is released.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

Thanks, applied now.


Takashi