From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C75A41F5821 for ; Sat, 13 Jun 2026 17:35:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781372121; cv=none; b=qlxIyqBuH60OAa3+zA3aTDm+u+GIW5ADlkA+72iniFx5Rw1iBo6xqGkC7EmieR1uLraRtsxl+kHwVTFfr+j073Mgi1+g2pXwQs4SUBf+xnU5YuSvqGm8yrbE+Fr36Jn8siLtwD5aMSBwkUPLdlzmDJv4cPJNyEUftUJCmwsj6Wo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781372121; c=relaxed/simple; bh=Sj4Nl538pldC4eksvSoSB07VkWQxEkzIoVuQnRq8JeU=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=Sj7id2ATvwBpBc+s+LdM6fIC1gCgyweJ7WL4q+JV8pHQyS9nURyJndqNvIx/RBdT7OH70ML5KJ0dLHmCOyYJHr3Rse34hKSoZVUdgoqN5r5orF8+sJ+9ZJkpFaThO/iv5AZxkrrdTPwdymLtxWrETKgy0/zsd3Vj8ToEZR63Ggs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IvY2Z3wj; arc=none smtp.client-ip=209.85.210.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IvY2Z3wj" Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-8423efd76c8so1519310b3a.0 for ; Sat, 13 Jun 2026 10:35:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781372119; x=1781976919; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=eMwch6akc+iC+N4/8qtQabSF3BiEL7PQv3Y1fEf2tBw=; b=IvY2Z3wjuH5TTAr6nlPlrAWrsJ+KS8ozgrpPzxDb/9x2LlbJf3j69xrKBOZwfZqpiX gVqoFSuG4ZsShItdEvq4GwoCWWfFa77eERE5VOJzLGKDsrvLfh69gaNRTnYrV1x1G8ML 5meCx42qXj5XTpjgW/6htRsCe2ajbrFZoivih56q9OdA1KGy8rnMuWnCE/t9Uy6455P0 tTJsWOK3TYd2yHW9QgMOvMLWK8DglnGNPJJzp5UBbdQNXBZb1tsW5Su7WQBVnQjRT3Jj DmZfYLPRO+baDFBsgpKrM0grpb/6HwP536Ykd3435Vj5wESzwUpLL4G8gnCRxNlhfMSI wipw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781372119; x=1781976919; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=eMwch6akc+iC+N4/8qtQabSF3BiEL7PQv3Y1fEf2tBw=; b=VM2KA/o/tq/x9HDC5sntu0Xf0ZEyBMstyWBxo1p38Mimc+mU3In7jZGKx81bO/67Je cHzPkbDewBDDPw34hv/3S92KUOtN5FldUVERDoE0xV38s29CYz/oL3f1kP9jJ5fTQP6l p9iv0Ewdc7kjn9UkMQ4CZnk8whG7+6oqs5nQ4Kb5wP5UsFF+NQ0Pg6+jA2w5jLlZ2RgT /SwswcIpfkpB0eSw7zip7j5nK2plBKriOZyTsE6VtWla6pm3/cLZdGee+tvZywl/Uy+3 n7QAjOW+XhKab6nYMO5Vhl4mPHISVZGy7G4E7FYi9QL2oNGEZfse48V345vd6W9yr/Sp EwXg== X-Forwarded-Encrypted: i=1; AFNElJ/KxAceWSvpS4DVSEav5e2W0p1enmeREU+G041unNPEZjJ38B276FcEDowUFazIV3Z9rBp12ImkYb5FFfc=@vger.kernel.org X-Gm-Message-State: AOJu0YzaW7vl2V/z3nijPpPHGzHxDuV77HcE5lWM/nqjN/Q6DwJwvLi+ gBZMiT/qP9YpkcRyKnQuMV3UdQV2rtmp+D7nYfAqaXoVlh73UV9sS0UW X-Gm-Gg: Acq92OFRTC2KWodpfc+szv+nUjJ5IIXyETj173uasmViWZw0NkgeqiG9/T45nyUR3O2 HxvIkqyGYM1P04ie9O9PmoXa5/mGULLifVypp+y5FLRGPO9sEUyTMgUOduw8p9gzJCrFBSoitDh wBUjaAgw8TbqYA5LSjtPV7Pyi4VegDJjIJhHT6O8lbBhdNz8erAAD5iVM3vdWOwIcO0axcjfcb+ vADfuvZgvRiMtAytMNCBv/rEeuiC6SGLm+Tee99xviYvjoFpAMVvToU/KikU8rcezcDCvljZexC z3a+/qTzYd8vZgZhgK/P8Qroexhg7u82pGgQ0ViyZxc/tIrz/U59Wei5wXXyf/RVM45Ks2TNIDN tzJivj5/oM/h2pS9x75vJRyuS93JcU4TYPCOE31sN777U7ee4eLNE/pyO+zJFtNT3+8CbIXQXuA kjCgqMh9a6G0X1oCKoUw== X-Received: by 2002:a05:6a00:2308:b0:842:2ddb:e303 with SMTP id d2e1a72fcca58-8434cd497dfmr8520715b3a.12.1781372119069; Sat, 13 Jun 2026 10:35:19 -0700 (PDT) Received: from localhost ([111.228.63.84]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8434b011288sm4945312b3a.44.2026.06.13.10.35.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 13 Jun 2026 10:35:18 -0700 (PDT) From: Cen Zhang To: Jaroslav Kysela , Takashi Iwai Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org, baijiaju1990@gmail.com, Cen Zhang Subject: [PATCH 1/2] ALSA: seq: oss: Serialize readq reset state with q->lock Date: Sun, 14 Jun 2026 01:35:12 +0800 Message-Id: <20260613173513.2370168-1-zzzccc427@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit snd_seq_oss_readq_clear() resets qlen, head, and tail without q->lock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset can therefore race snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave stale records in the queue, drop freshly queued ones, or report the wrong readiness after wakeup. KCSAN reports a data race between snd_seq_oss_readq_clear() and snd_seq_oss_readq_free(). Take q->lock while clearing the ring and resetting input_time. Factor the enqueue logic into a caller-locked helper so snd_seq_oss_readq_put_timestamp() updates its suppression state under the same lock instead of racing the reset path. The buggy scenario involves two paths, with each column showing the order within that path: reset path: locked readq updater: 1. snd_seq_oss_reset() or 1. A reader or callback producer release reaches takes q->lock on the same queue. snd_seq_oss_readq_clear(). 2. snd_seq_oss_readq_clear() 2. The updater tests or modifies resets qlen, head, tail, qlen, head, and tail. and input_time. 3. snd_seq_oss_readq_clear() 3. The updater completes its wakes sleepers on read-modify-write sequence. q->midi_sleep. 4. Without q->lock, the reset 4. The resulting ring state drives can overlap the locked later reads and readiness. update. Signed-off-by: Cen Zhang --- sound/core/seq/oss/seq_oss_readq.c | 77 ++++++++++++++++++++---------- 1 file changed, 52 insertions(+), 25 deletions(-) diff --git a/sound/core/seq/oss/seq_oss_readq.c b/sound/core/seq/oss/seq_oss_readq.c index c880d4771169..06e12707db21 100644 --- a/sound/core/seq/oss/seq_oss_readq.c +++ b/sound/core/seq/oss/seq_oss_readq.c @@ -73,13 +73,17 @@ snd_seq_oss_readq_delete(struct seq_oss_readq *q) void snd_seq_oss_readq_clear(struct seq_oss_readq *q) { - if (q->qlen) { - q->qlen = 0; - q->head = q->tail = 0; + scoped_guard(spinlock_irqsave, &q->lock) { + if (q->qlen) { + q->qlen = 0; + q->head = 0; + q->tail = 0; + } + q->input_time = (unsigned long)-1; } + /* if someone sleeping, wake'em up */ wake_up(&q->midi_sleep); - q->input_time = (unsigned long)-1; } /* @@ -136,11 +140,11 @@ int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev, /* * copy an event to input queue: * return zero if enqueued + * caller must hold lock */ -int -snd_seq_oss_readq_put_event(struct seq_oss_readq *q, union evrec *ev) +static int snd_seq_oss_readq_put_event_locked(struct seq_oss_readq *q, + union evrec *ev) { - guard(spinlock_irqsave)(&q->lock); if (q->qlen >= q->maxlen - 1) return -ENOMEM; @@ -148,12 +152,27 @@ snd_seq_oss_readq_put_event(struct seq_oss_readq *q, union evrec *ev) q->tail = (q->tail + 1) % q->maxlen; q->qlen++; - /* wake up sleeper */ - wake_up(&q->midi_sleep); - return 0; } +/* + * copy an event to input queue: + * return zero if enqueued + */ +int +snd_seq_oss_readq_put_event(struct seq_oss_readq *q, union evrec *ev) +{ + int rc; + + scoped_guard(spinlock_irqsave, &q->lock) { + rc = snd_seq_oss_readq_put_event_locked(q, ev); + if (!rc) + wake_up(&q->midi_sleep); + } + + return rc; +} + /* * pop queue @@ -209,23 +228,31 @@ snd_seq_oss_readq_poll(struct seq_oss_readq *q, struct file *file, poll_table *w int snd_seq_oss_readq_put_timestamp(struct seq_oss_readq *q, unsigned long curt, int seq_mode) { - if (curt != q->input_time) { - union evrec rec; - memset(&rec, 0, sizeof(rec)); - switch (seq_mode) { - case SNDRV_SEQ_OSS_MODE_SYNTH: - rec.echo = (curt << 8) | SEQ_WAIT; - snd_seq_oss_readq_put_event(q, &rec); - break; - case SNDRV_SEQ_OSS_MODE_MUSIC: - rec.t.code = EV_TIMING; - rec.t.cmd = TMR_WAIT_ABS; - rec.t.time = curt; - snd_seq_oss_readq_put_event(q, &rec); - break; + int queued = 0; + + scoped_guard(spinlock_irqsave, &q->lock) { + if (curt != q->input_time) { + union evrec rec; + + memset(&rec, 0, sizeof(rec)); + switch (seq_mode) { + case SNDRV_SEQ_OSS_MODE_SYNTH: + rec.echo = (curt << 8) | SEQ_WAIT; + queued = !snd_seq_oss_readq_put_event_locked(q, &rec); + break; + case SNDRV_SEQ_OSS_MODE_MUSIC: + rec.t.code = EV_TIMING; + rec.t.cmd = TMR_WAIT_ABS; + rec.t.time = curt; + queued = !snd_seq_oss_readq_put_event_locked(q, &rec); + break; + } + q->input_time = curt; } - q->input_time = curt; } + if (queued) + wake_up(&q->midi_sleep); + return 0; } -- 2.43.0