From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f182.google.com (mail-dy1-f182.google.com [74.125.82.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 612E63DD84A for ; Wed, 10 Jun 2026 11:31:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781091101; cv=none; b=bL952ijmugynDTQjPAmplJv3t/aqK/2W6XXLHRkiyjWLOuPJvCwhHx33pS4xn4cYQgqlOP0y7G4WMJ54Jn5Bk8JQU/SoJUSJSph5OVWYzK53XLeRcSFbYCI5Cnt7nuE4URjGYWUsvdB7vfqFSr5VBzuerelEv66BR6NUHS6QhOI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781091101; c=relaxed/simple; bh=3IAAvA1ob7pethFiA7dKC6y23wTdIBbctXcRef2X33s=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=tmFrZumakhobLGthqA6WL6aS50A3vZjngTkX5Fvl8fwvvjRayRxTfwFCp9tHRRLU1WqFAKuRmLFzpleoAt3qm/f+TvyaiKxqJxhX/LnXQDwvTmicWch138q64pnG//xB1JwtPL5/8rOdVCYmaYd8tIN62YcTBkOKaKkwKjXMPhM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=paf2Vmdh; arc=none smtp.client-ip=74.125.82.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="paf2Vmdh" Received: by mail-dy1-f182.google.com with SMTP id 5a478bee46e88-304e83724bfso8302957eec.0 for ; Wed, 10 Jun 2026 04:31:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781091099; x=1781695899; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=uQo9gzwulktZCqCaEW3KCw8KlpR36HoTf+0oPiH7bkg=; b=paf2Vmdh1lh318iyuvDjO8YJRXzcmL6iaT2tbnXd7ELY11EPPK0q2UdbFdtpUn2nvh a47I2d58g9C2G7xrxXyGrpWhBFouRnTNSZEGDKGitPxfoaRaRnYn9Cpjv5mT0yUxDA8Q +Pp1ohIeG7hdF/6wRAD04eIb2wK/jpvo8R25R/jJXcJzhjREPU703ef3hxwYqMnJu5nm cTi5oB0c7GySQXLUixbCn2AlM0oj2WmeLisC+v6u12aPBRh67p4yCETd9aoo1OUiBLIt AmqicC/LqkV8KUgX7wswOiFok2g37ZvUvYoZ1TnefaD+0Ny1/TWN5Zg1YvicOR/QRI28 lzTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781091099; x=1781695899; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=uQo9gzwulktZCqCaEW3KCw8KlpR36HoTf+0oPiH7bkg=; b=ULoENbkxNbVZ1DgCOc1LOjuGe1bfXG1OGIjGmU7LJyTk3kX7xOxFw8juKQpJPWDkMc hcj4EaF9fBgLCS1BfSKNmwfX/ohQUCqGcDc6W9Meypl67VNnQ9GyiS08oFLtq/zi6FCS Slcrc8ENn/bCsgrcobV5sesIlx2bKbrBcShpZkCxNloP7Rd1nPgZdwdBX0Y6ySCOEtOE HJnGB1BcT9eG3XUu7/+fqORwE2gVHUDyHNqkntPfyjfkzm4R95SHjRhDShArmjB6VY9R /ufA0CesovabdyXsedP8Woq441P7tQH/qPUqzlSL6S6eAvdJ7ybCHs3rEePNZYfR76r/ cTOQ== X-Forwarded-Encrypted: i=1; AFNElJ9Ngr1U67Trbg0y4jYU9q1wK5pTGZw74nXcK/egIlljkRPSVbHJyI3q4BL1CAMCovZG/TbjWd15nuNbRr4=@vger.kernel.org X-Gm-Message-State: AOJu0YxQb598WRivxP6s311fe7pSSOWiawmYMTF048pO7Nh155IDlHOW y2Q0dxbsyIvf19RqqT+/1/s3qbc5pMNAk1fC47B3N+g5M21RR6fW3LRYtkjzXA== X-Gm-Gg: Acq92OFq1jOpoZXCpZnBPwQcYCTbzy6Hp+qCfmd9ucixHsTpkkhmZ+P2lUcFpStpkRU 0p/VpQYpwFSaICRbvIajgR+exPnkvYg4doDuEXIdKP0CndpK+gloNrflMoQD+D3z9BtDk+TL+g1 biuAdJYGBmY+Wd3ljovS3/bvq/zRcWTE8iyqKBHZQOgfPRAit4crxCB4nWZLaGe7MKEaJTmgtpM A6hosqeA4MUIp1rAeSKtbIQAsFgG8tm23cfsCyZuWyd5xVJPVi0SbZz0pw30dKcn3W1Wk7M0jVA gNzBr37GSCieYbJcvhKx7cyUOPlM0JkATCxC/dDlbXZ+4GsYLzNOcKg1+Fd3xK+GoUXLKork2Ik 5JN5ZsdZ1SA30wT469hr6xLo6z00o8++guewFZxVepdIjvbgmKKvu2DZYYRGO+B/WvCvKPJKuQy vfF8qQJ8FslimaQcS4dD+ogl7CjUHQHNSxrR+yx1Wq/x9OO8jzLDo1LpFMRN8D0spi1U/gOmYud qa5cqu1gtEK X-Received: by 2002:a05:7301:a84:b0:2d8:71c2:255d with SMTP id 5a478bee46e88-3077b3cf954mr16010726eec.14.1781091099197; Wed, 10 Jun 2026 04:31:39 -0700 (PDT) Received: from [192.168.1.18] (177-4-161-23.user3p.v-tal.net.br. [177.4.161.23]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3074db85e10sm24816612eec.7.2026.06.10.04.31.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 Jun 2026 04:31:38 -0700 (PDT) From: =?utf-8?q?C=C3=A1ssio_Gabriel?= Date: Wed, 10 Jun 2026 08:31:30 -0300 Subject: [PATCH] ALSA: pcm: Fix unlocked state reads in read/write file ops Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20260610-alsa-pcm-read-write-state-helper-v1-1-93b7b992db09@gmail.com> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/yXNQQrCMBCF4auUWTuQhhLRq4iLSTq1I7WGmVQLp Xc36ubBt/nfBsYqbHBuNlB+iclzrmgPDaSR5huj9NXgnQ8uuBZpMsKcHqhMPb5VCqMVqjvylFn x5ImG0CUf4xFqJisPsv4uLte/bYl3TuXbhX3/AIE88zyEAAAA X-Change-ID: 20260601-alsa-pcm-read-write-state-helper-92aaf64c2bb7 To: Takashi Iwai , Jaroslav Kysela Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org, notify@kernel.org, =?utf-8?q?C=C3=A1ssio_Gabriel?= X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=3133; i=cassiogabrielcontato@gmail.com; h=from:subject:message-id; bh=3IAAvA1ob7pethFiA7dKC6y23wTdIBbctXcRef2X33s=; b=owGbwMvMwCV2IdZeKur/u2bG02pJDFma3hKNq5+dPHb/4P9v/I2tV1XNPjekXUvmjD1exKedN oXXSMGpo5SFQYyLQVZMkWV10iLLPV0PrtbHrfCAmcPKBDKEgYtTACbyUpKRYVVeV8a17vz/6m2R 04vWxQVcLqspPr/L4Nmqav/Zmc966hn+WVlfmXP0MuvfjSdkNyjcWXay5kLk5M21KTk35tWnRF/ j5gEA X-Developer-Key: i=cassiogabrielcontato@gmail.com; a=openpgp; fpr=AB62A239BC8AE0D57F5EA848D05D3F1A5AFFEE83 The PCM read/write and readv/writev file operations reject streams in OPEN or DISCONNECTED state before accessing the configured runtime parameters. However, each operation reads runtime->state without the PCM stream lock. PCM state updates are serialized by the stream lock and may occur concurrently from IRQ context. Use a local predicate based on snd_pcm_get_state() to take a locked state snapshot for these VFS entry checks. This also consolidates the duplicated OPEN and DISCONNECTED tests. The conditions and returned errors remain unchanged. Signed-off-by: Cássio Gabriel --- base-commit: 16b06f4e78f969e046991b2fb861cb6832248319 --- sound/core/pcm_native.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index db4f5cb39088..7dc0060617f1 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -645,6 +645,14 @@ snd_pcm_state_t snd_pcm_get_state(struct snd_pcm_substream *substream) } EXPORT_SYMBOL_GPL(snd_pcm_get_state); +static bool snd_pcm_state_open_or_disconnected(struct snd_pcm_substream *substream) +{ + snd_pcm_state_t state = snd_pcm_get_state(substream); + + return state == SNDRV_PCM_STATE_OPEN || + state == SNDRV_PCM_STATE_DISCONNECTED; +} + static inline void snd_pcm_timer_notify(struct snd_pcm_substream *substream, int event) { @@ -3569,8 +3577,7 @@ static ssize_t snd_pcm_read(struct file *file, char __user *buf, size_t count, if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime = substream->runtime; - if (runtime->state == SNDRV_PCM_STATE_OPEN || - runtime->state == SNDRV_PCM_STATE_DISCONNECTED) + if (snd_pcm_state_open_or_disconnected(substream)) return -EBADFD; if (!frame_aligned(runtime, count)) return -EINVAL; @@ -3594,8 +3601,7 @@ static ssize_t snd_pcm_write(struct file *file, const char __user *buf, if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime = substream->runtime; - if (runtime->state == SNDRV_PCM_STATE_OPEN || - runtime->state == SNDRV_PCM_STATE_DISCONNECTED) + if (snd_pcm_state_open_or_disconnected(substream)) return -EBADFD; if (!frame_aligned(runtime, count)) return -EINVAL; @@ -3621,8 +3627,7 @@ static ssize_t snd_pcm_readv(struct kiocb *iocb, struct iov_iter *to) if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime = substream->runtime; - if (runtime->state == SNDRV_PCM_STATE_OPEN || - runtime->state == SNDRV_PCM_STATE_DISCONNECTED) + if (snd_pcm_state_open_or_disconnected(substream)) return -EBADFD; if (!user_backed_iter(to)) return -EINVAL; @@ -3661,8 +3666,7 @@ static ssize_t snd_pcm_writev(struct kiocb *iocb, struct iov_iter *from) if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime = substream->runtime; - if (runtime->state == SNDRV_PCM_STATE_OPEN || - runtime->state == SNDRV_PCM_STATE_DISCONNECTED) + if (snd_pcm_state_open_or_disconnected(substream)) return -EBADFD; if (!user_backed_iter(from)) return -EINVAL;