From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 86D628460 for ; Sun, 14 Jun 2026 00:48:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781398091; cv=none; b=nMznKQcvp5xOhRTmAyUjk8eLRCyH/JgNI0E1Z7ATyWKWlq4n6u5IhiFBCSkGuODTboEC7V7lBdevCeHbVlvNp4+JQ3FkD5grZhTnDrm8iRUj11D+nyWUYTCSBp8w7hXOKcyVUw5ywHvcSNCxcFgucGHpVmGSMY/76p84jfa40OA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781398091; c=relaxed/simple; bh=+x67wBaaQqcvEWlcEgiK+KXxKahwmA1RZsTVZuoZtcI=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=jAeWtSsIAGeLSOKhkP2H4aDUBQze7dzAshAdvLhC/No9JzKT+f0E3gTQn9Tr/QnDY5i1Ly5vjXbPpovldmK6PMkTbdaBqx6sJMdnIa7QUC3gx4doV7PXh6WiqAoOnI7xwBf3ATI4R5LFNalIcdMIJO1kmdIP+HbkbOvUzHzm3OQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AJWDo7cs; arc=none smtp.client-ip=209.85.216.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AJWDo7cs" Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-36b8d414666so1339441a91.3 for ; Sat, 13 Jun 2026 17:48:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781398088; x=1782002888; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=IGjAOq97KN0d/Ivqo0JiBpqmA0waLeyuLIhwmyJu2P0=; b=AJWDo7cs//bYXxFUbOw3WTc1GMrbk3GNeo7z7lXJh1BSw7CpuIXT0tVlt6lpPanf+b gJtc/DhowBu/WAPpzNCVzgjJpdReAGzK0yem//o9OQy+K/218vn7fnkbX1T0pPxtKFd0 skKeyAewNqDbvnuWh+OVMRQ00qLuOvJqynS8As5wtqXfG6Tyx9mVHXBQ9ZBUEOFZqo9C 4si2ubxr9pokS2FxQgZY9u8cGkxtk1NBY+WOBBmFAH5byGdbgQjRlas44zyUIsm8AiOK dUO4Foidl3C+Rb1ko+fha4S1gUsRsNkXR2la3Db5oNSHfkOD38XlLUA+CeLqRYXyPAE3 /33Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781398088; x=1782002888; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=IGjAOq97KN0d/Ivqo0JiBpqmA0waLeyuLIhwmyJu2P0=; b=EIwbUU7XqFKi/nPHb3jzivNscNIJaQbCeb9UMgNz3CurIZglXae0BP/OL+S3h/AhFu 4utY0A2/2Fi0WxOwXPaG9p8vei24jL+6bOe0aLAR7K+pA+WWLPh/rIwRFJiVTFnnzTwl osZ0cYAVTrcd9NNGQ2KsbWmC7V6qNVQBFp519jr/9ksXcxCWG6BLyZXlMGwMtGYjCVgL fTNEaW7AgVHPCK3T+7mTsOLnZcRDuiR4WQTQdoPPy5b/RCmjYaDh7NOYi3ddYWEjJDT/ k0YiLplYcJBPFPfUnku9EYAWdqyMAMamfp9VJEiOEBwS0JnzspAFqNtftkfTJh17pKvc 042g== X-Forwarded-Encrypted: i=1; AFNElJ+MWqmtVE9GCXNu7Kp3vOkou/l919SgEpNs9TW1rWhFxUKI3jOcjJii79qGA6f7MzEVuK1MjGQFICrpkU4=@vger.kernel.org X-Gm-Message-State: AOJu0YyamLWUn4mbO2hsxHzOnFuDGYqMCoXDh5DJBZdV4E9B5EDBgyes 10Yv0sEKbvR3aH7Dd/s3D7SXFrNC5T3uNZWwvOm703bnEZcIE/u4FX9E X-Gm-Gg: Acq92OGgyXKovv0H3coAXoAX2gfZDudVX3dLnbsFtdV2Ivg37W15mwMJHR2bkxYwjA7 9uryxcprf+p/IppcnCT+IhRl1vQQVY2FjX2RKG3ZWEfq6ag2Nhn5RauOXOVi1Cl0S7VVao1f7H/ YFFKk3YchRHVg0W8OZmxSN5F6L3JTrwg4BpsB+55Ms5kUhv0vpYWQQ4J07M7MFzqFghkfdmMo+4 +IEmf4h+PE8Xiw+kYILrXBVOmgGTtSzfoBv2uSwjDpO5OkmVbV4YyK1LlSTw4tNBQGvy9N4zXRo kujS6FF4P24TMUmTTBRaDZK3htobmxDCvkneP6KLOJOdpdASECvg9eEZ2bIva/kBufTXcsXrmhg mc2M61Qn9cAf/VXd77EsCedBvuGGNECmso+mlSiiQXi/sE8EpVYor4bVBcJ/Bi3/E422fCh/AAb fWG0aX/jJ3Am9Qe6V3S1gRUTscWDCN X-Received: by 2002:a17:90b:53c8:b0:35e:d015:d675 with SMTP id 98e67ed59e1d1-37a01c34700mr9709607a91.7.1781398087814; Sat, 13 Jun 2026 17:48:07 -0700 (PDT) Received: from localhost ([111.228.63.84]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-379e754e02dsm2962808a91.1.2026.06.13.17.48.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 13 Jun 2026 17:48:07 -0700 (PDT) From: Cen Zhang To: Jaroslav Kysela , Takashi Iwai Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org, baijiaju1990@gmail.com, Cen Zhang Subject: [PATCH v2 1/2] ALSA: seq: oss: Serialize readq reset state with q->lock Date: Sun, 14 Jun 2026 08:48:00 +0800 Message-Id: <20260614004801.3507773-1-zzzccc427@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit snd_seq_oss_readq_clear() resets qlen, head, and tail without q->lock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset can therefore race snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave stale records in the queue, drop freshly queued ones, or report the wrong readiness after wakeup. KCSAN reports a data race between snd_seq_oss_readq_clear() and snd_seq_oss_readq_free(). Take q->lock while clearing the ring and resetting input_time. Factor the enqueue logic into a caller-locked helper so snd_seq_oss_readq_put_timestamp() updates its suppression state under the same lock instead of racing the reset path. The buggy scenario involves two paths, with each column showing the order within that path: reset path: locked readq updater: 1. snd_seq_oss_reset() or 1. A reader or callback producer release reaches takes q->lock on the same queue. snd_seq_oss_readq_clear(). 2. snd_seq_oss_readq_clear() 2. The updater tests or modifies resets qlen, head, tail, qlen, head, and tail. and input_time. 3. snd_seq_oss_readq_clear() 3. The updater completes its wakes sleepers on read-modify-write sequence. q->midi_sleep. 4. Without q->lock, the reset 4. The resulting ring state drives can overlap the locked later reads and readiness. update. KCSAN reports: BUG: KCSAN: data-race in snd_seq_oss_readq_clear / snd_seq_oss_readq_free write to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0: snd_seq_oss_readq_free+0x6c/0x80 snd_seq_oss_read+0xcb/0x250 odev_read+0x38/0x60 vfs_read+0xff/0x600 ksys_read+0xb4/0x140 __x64_sys_read+0x46/0x60 do_syscall_64+0xbb/0x2f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1: snd_seq_oss_readq_clear+0x1f/0x90 snd_seq_oss_reset+0xa7/0xf0 snd_seq_oss_ioctl+0x6f6/0x7e0 odev_ioctl+0x56/0xc0 __x64_sys_ioctl+0xd1/0x120 do_syscall_64+0xbb/0x2f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000001 -> 0x00000000 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Cen Zhang --- sound/core/seq/oss/seq_oss_readq.c | 77 ++++++++++++++++++++---------- 1 file changed, 52 insertions(+), 25 deletions(-) diff --git a/sound/core/seq/oss/seq_oss_readq.c b/sound/core/seq/oss/seq_oss_readq.c index c880d4771169..06e12707db21 100644 --- a/sound/core/seq/oss/seq_oss_readq.c +++ b/sound/core/seq/oss/seq_oss_readq.c @@ -73,13 +73,17 @@ snd_seq_oss_readq_delete(struct seq_oss_readq *q) void snd_seq_oss_readq_clear(struct seq_oss_readq *q) { - if (q->qlen) { - q->qlen = 0; - q->head = q->tail = 0; + scoped_guard(spinlock_irqsave, &q->lock) { + if (q->qlen) { + q->qlen = 0; + q->head = 0; + q->tail = 0; + } + q->input_time = (unsigned long)-1; } + /* if someone sleeping, wake'em up */ wake_up(&q->midi_sleep); - q->input_time = (unsigned long)-1; } /* @@ -136,11 +140,11 @@ int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev, /* * copy an event to input queue: * return zero if enqueued + * caller must hold lock */ -int -snd_seq_oss_readq_put_event(struct seq_oss_readq *q, union evrec *ev) +static int snd_seq_oss_readq_put_event_locked(struct seq_oss_readq *q, + union evrec *ev) { - guard(spinlock_irqsave)(&q->lock); if (q->qlen >= q->maxlen - 1) return -ENOMEM; @@ -148,12 +152,27 @@ snd_seq_oss_readq_put_event(struct seq_oss_readq *q, union evrec *ev) q->tail = (q->tail + 1) % q->maxlen; q->qlen++; - /* wake up sleeper */ - wake_up(&q->midi_sleep); - return 0; } +/* + * copy an event to input queue: + * return zero if enqueued + */ +int +snd_seq_oss_readq_put_event(struct seq_oss_readq *q, union evrec *ev) +{ + int rc; + + scoped_guard(spinlock_irqsave, &q->lock) { + rc = snd_seq_oss_readq_put_event_locked(q, ev); + if (!rc) + wake_up(&q->midi_sleep); + } + + return rc; +} + /* * pop queue @@ -209,23 +228,31 @@ snd_seq_oss_readq_poll(struct seq_oss_readq *q, struct file *file, poll_table *w int snd_seq_oss_readq_put_timestamp(struct seq_oss_readq *q, unsigned long curt, int seq_mode) { - if (curt != q->input_time) { - union evrec rec; - memset(&rec, 0, sizeof(rec)); - switch (seq_mode) { - case SNDRV_SEQ_OSS_MODE_SYNTH: - rec.echo = (curt << 8) | SEQ_WAIT; - snd_seq_oss_readq_put_event(q, &rec); - break; - case SNDRV_SEQ_OSS_MODE_MUSIC: - rec.t.code = EV_TIMING; - rec.t.cmd = TMR_WAIT_ABS; - rec.t.time = curt; - snd_seq_oss_readq_put_event(q, &rec); - break; + int queued = 0; + + scoped_guard(spinlock_irqsave, &q->lock) { + if (curt != q->input_time) { + union evrec rec; + + memset(&rec, 0, sizeof(rec)); + switch (seq_mode) { + case SNDRV_SEQ_OSS_MODE_SYNTH: + rec.echo = (curt << 8) | SEQ_WAIT; + queued = !snd_seq_oss_readq_put_event_locked(q, &rec); + break; + case SNDRV_SEQ_OSS_MODE_MUSIC: + rec.t.code = EV_TIMING; + rec.t.cmd = TMR_WAIT_ABS; + rec.t.time = curt; + queued = !snd_seq_oss_readq_put_event_locked(q, &rec); + break; + } + q->input_time = curt; } - q->input_time = curt; } + if (queued) + wake_up(&q->midi_sleep); + return 0; } -- 2.43.0