Re: [PATCH] ALSA: control_led: Fix deadlock between sysfs writes and card disconnect

["Ali Ahmet Memiş" <aliamemis@disroot.org>]

On Mon, 12 Oct 2026 09:24:26 +0200, Takashi Iwai wrote:
> Hm, it's not clear to me how this happens: I see no controls_rwsem
> down around snd_ctl_led_disconnect() call.  Could you elaborate about
> it a bit more?

It's taken in the call_snd_ctl_lops() macro in control.c:

	guard(rwsem_read)(&(_card)->controls_rwsem);
	guard(rwsem_read)(&snd_ctl_layer_rwsem);

so snd_ctl_dev_disconnect() calls ->ldisconnect() with controls_rwsem
held for read.  snd_ctl_led_sysfs_remove() then waits in kernfs_drain()
for the attach write which is blocked on down_write(controls_rwsem) in
snd_ctl_led_set_id().

I hit it in QEMU with snd-dummy writing to attach in a loop while
unloading the module.  It hung on the third iteration:

rmmod:
[<0>] kernfs_drain+0x2eb/0x510
[<0>] __kernfs_remove+0x2e6/0x890
[<0>] kernfs_remove_by_name_ns+0x7d/0x100
[<0>] remove_files+0x8d/0x1b0
[<0>] sysfs_remove_group+0x71/0xd0
[<0>] sysfs_remove_groups+0x67/0xd0
[<0>] device_remove_attrs+0x181/0x270
[<0>] device_del+0x31f/0x8d0
[<0>] device_unregister+0x12/0x30
[<0>] snd_ctl_led_sysfs_remove+0x161/0x2f0
[<0>] snd_ctl_led_disconnect+0x16/0xd0
[<0>] snd_ctl_dev_disconnect+0x151/0x210
[<0>] snd_device_disconnect_all+0xf0/0x180
[<0>] snd_card_disconnect.part.0+0x25d/0x4c0

attach writer:
[<0>] set_led_id+0x2d9/0xc60
[<0>] kernfs_fop_write_iter+0x33c/0x510
[<0>] vfs_write+0x516/0x1340

and lockdep reports it as well:

  Possible unsafe locking scenario:
        CPU0                    CPU1
        ----                    ----
   rlock(snd_ctl_layer_rwsem);
                                lock(&card->controls_rwsem);
                                lock(snd_ctl_layer_rwsem);
   lock(kn->active#37);

   #1: ffff88800768a1f0 (&card->controls_rwsem){++++}-{4:4}, at: snd_ctl_dev_disconnect+0x10e/0x210
   #2: ffffffff881fdf28 (snd_ctl_layer_rwsem){++++}-{4:4}, at: snd_ctl_dev_disconnect+0x11a/0x210