Re: [PATCH] ALSA: pcm: wake linked drain waiters on unlink
Takashi Iwai <[email protected]>
| Newsgroups | org.kernel.vger.linux-sound |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 28 Jul 2026 14:50:01 +0200,
Norbert Szetei wrote:
>
> snd_pcm_drain() on a linked stream parks an on-stack wait entry on the
> drained peer's runtime->sleep, and after schedule_timeout() removes it
> only if that peer is still found in the caller's group. If group
> membership changes during the wait and the sleep ends by signal or
> timeout (so autoremove_wake_function() does not run), finish_wait() is
> skipped and snd_pcm_drain() returns with the entry still queued on that
> stream's sleep list; a later wake_up() then walks a freed stack frame.
> This is reachable by unlinking either the drained or the draining stream.
>
> Unlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()),
> snd_pcm_unlink() never wakes the sleep queues. Wake every group member
> under the group lock before the membership change, so a linked drainer is
> released and drops its entry while the streams are still grouped.
>
> The window was opened when snd_pcm_link_rwsem stopped being held across
> the wait and the removal became conditional on group membership (see
> Fixes). The later switch to finish_wait() kept that conditional removal,
> so the signal/timeout case remained.
>
> Fixes: f57f3df03a8e ("ALSA: pcm: More fine-grained PCM link locking")
> Cc: [email protected]
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Norbert Szetei <[email protected]>
Applied now. Thanks.
Takashi