Re: [PATCH v2] ALSA: seq: midi: Serialize input teardown with event_input
Takashi Iwai <[email protected]>
| Newsgroups | gmane.linux.sound,gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 13 Aug 2026 17:08:08 +0200,
John Keeping wrote:
>
> snd_midi_input_event() must not be running while a rawmidi substream is
> closing, since this can lead to the trigger state becoming out-of-step
> through this sequence in snd_rawmidi_input_trigger():
>
> snd_rawmidi_input_trigger(up=0)
> snd_midi_input_event()
> -> snd_rawmidi_kernel_read()
> -> snd_rawmidi_input_trigger(up=1)
> -> cancel_work_sync()
>
> which ends with the underlying device being active unexpectedly.
>
> When this is called from close_substream(), further input can re-trigger
> the input event leaving it running after rawmidi_release_priv() has set
> rfile->rmidi to NULL which leads to:
>
> Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0
> Call trace:
> snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P)
> snd_rawmidi_input_event_work+0x1c/0x2c
> process_one_work+0x150/0x3a4
> worker_thread+0x190/0x318
>
> Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi:
> Serialize output teardown with event_input") which fixed the same issue
> in the output direction, but updated to use RCU following Takashi Iwai's
> proposed follow-on patch [1].
>
> With this change in place, midisynth_unsubscribe() clears the input file
> so snd_midi_input_event() will not re-trigger the stream and will be
> quiesced by the cancel_work_sync() in snd_rawmidi_input_trigger().
>
> [1] https://lore.kernel.org/linux-sound/[email protected]/
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: John Keeping <[email protected]>
> ---
> Changes in v2:
> - Switch to using RCU following Takashi's suggestion
Applied to for-next branch now. Thanks.
Takashi