[PATCH] ALSA: pcm: Remove channel-map controls before freeing substreams

[PATCH] ALSA: pcm: Remove channel-map controls before freeing substreams

[Cen Zhang]

A late HDA codec bind on an already registered card builds new PCMs
before registering them. add_std_chmaps() publishes generic channel-map
controls during this BUILD stage. If an earlier chmap succeeds and a
later allocation fails, probe cleanup frees the BUILD PCM while the
card's control device remains accessible.

These generic controls are added directly by snd_pcm_add_chmap_ctls();
snd_hda_ctls_clear() only removes codec-tracked mixer controls. BUILD
devices also skip dev_disconnect. snd_pcm_free_stream() then frees the
substreams before free_chmap() withdraws their generic control:

  Late HDA codec bind / rollback        Control GET on the live card
  ------------------------------       ----------------------------
  hda_codec_driver_probe()
    snd_hda_codec_build_pcms()
      PCM is BUILD
    snd_hda_codec_build_controls()
      add_std_chmaps()
        publish an earlier chmap
        later allocation: -ENOMEM
    snd_hda_codec_cleanup_for_unbind()
      snd_hda_ctls_clear()
        generic chmap remains
      codec_release_pcms()
        snd_device_free()
          BUILD: skip dev_disconnect
          snd_pcm_free_stream()
            kfree(substream)
                                       snd_ctl_elem_read()
                                         down_read(controls_rwsem)
                                         pcm_chmap_ctl_get()
                                           walk freed substream
            free_chmap()
              snd_ctl_remove()
                wait for GET
                                         up_read(controls_rwsem)

The control read lock cannot protect a substream already freed before
control removal starts. The failure above occurs before
snd_card_register(), so the PCM has not transitioned out of BUILD.

Move free_chmap() before the substream free loop. Its snd_ctl_remove()
withdraws the control and drains readers under controls_rwsem before any
substream is released. Normal registered-device disconnect already
removes the control, so the later call remains harmless on that path.

Fixes: 2d3391ec0ecc ("ALSA: PCM: channel mapping API implementation")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>

---

diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 41c2cab7a52c412b7c68374059cd305a6b3fe3d7..36c3b7cc742abeff889a96b452a88d267763caa4 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -819,6 +819,9 @@ static void snd_pcm_free_stream(struct snd_pcm_str * pstr)
 	/* free all proc files under the stream */
 	snd_pcm_stream_proc_done(pstr);
 
+	/* Drain channel-map callbacks before freeing the substreams. */
+	free_chmap(pstr);
+
 	substream = pstr->substream;
 	while (substream) {
 		substream_next = substream->next;
@@ -833,7 +836,6 @@ static void snd_pcm_free_stream(struct snd_pcm_str * pstr)
 		kfree(setup);
 	}
 #endif
-	free_chmap(pstr);
 	if (pstr->substream_count)
 		put_device(pstr->dev);
 }

Re: [PATCH] ALSA: pcm: Remove channel-map controls before freeing substreams

[Takashi Iwai]

On Mon, 19 Oct 2026 12:01:46 +0200,
Cen Zhang wrote:
> 
> A late HDA codec bind on an already registered card builds new PCMs
> before registering them. add_std_chmaps() publishes generic channel-map
> controls during this BUILD stage. If an earlier chmap succeeds and a
> later allocation fails, probe cleanup frees the BUILD PCM while the
> card's control device remains accessible.
> 
> These generic controls are added directly by snd_pcm_add_chmap_ctls();
> snd_hda_ctls_clear() only removes codec-tracked mixer controls. BUILD
> devices also skip dev_disconnect. snd_pcm_free_stream() then frees the
> substreams before free_chmap() withdraws their generic control:
> 
>   Late HDA codec bind / rollback        Control GET on the live card
>   ------------------------------       ----------------------------
>   hda_codec_driver_probe()
>     snd_hda_codec_build_pcms()
>       PCM is BUILD
>     snd_hda_codec_build_controls()
>       add_std_chmaps()
>         publish an earlier chmap
>         later allocation: -ENOMEM
>     snd_hda_codec_cleanup_for_unbind()
>       snd_hda_ctls_clear()
>         generic chmap remains
>       codec_release_pcms()
>         snd_device_free()
>           BUILD: skip dev_disconnect
>           snd_pcm_free_stream()
>             kfree(substream)
>                                        snd_ctl_elem_read()
>                                          down_read(controls_rwsem)
>                                          pcm_chmap_ctl_get()
>                                            walk freed substream
>             free_chmap()
>               snd_ctl_remove()
>                 wait for GET
>                                          up_read(controls_rwsem)
> 
> The control read lock cannot protect a substream already freed before
> control removal starts. The failure above occurs before
> snd_card_register(), so the PCM has not transitioned out of BUILD.
> 
> Move free_chmap() before the substream free loop. Its snd_ctl_remove()
> withdraws the control and drains readers under controls_rwsem before any
> substream is released. Normal registered-device disconnect already
> removes the control, so the later call remains harmless on that path.
> 
> Fixes: 2d3391ec0ecc ("ALSA: PCM: channel mapping API implementation")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>

Applied now.  Thanks.


Takashi