[PATCH] ALSA: opl3: Stop delayed note-offs before freeing the channel set

[PATCH] ALSA: opl3: Stop delayed note-offs before freeing the channel set

[Cen Zhang]

An in-tree OPL3 device accepts FM instruments through its hwdep write
interface. Loading a bank-127 instrument with nonzero fix_dur and sending
a direct NOTEON without a subscription leaves the device in its initial
SYNTH mode. snd_opl3_note_on() sets the note_off deadline, starts tlist
at the next jiffy and stores the channel pointer in a voice.

Unbinding the OPL3 sequencer device can then free the port's channel set
while the card-owned OPL3 object and its timer remain alive. Port removal
drains event_input users, but the timer is independent. Without a
subscription, no unuse callback runs to perform its timer cleanup:

  NOTEON / sequencer-device unbind      Delayed-note timer
  -------------------------------      ------------------
  snd_opl3_note_on()
    lock(voice_lock)
    set voice->note_off deadline
    snd_opl3_start_timer()
      mod_timer(tlist, jiffies + 1)
    voice->note_off_check = 1
    voice->chan = channel
    unlock(voice_lock)
  NOTEON returns
  sysfs driver unbind
    snd_opl3_seq_remove()
      snd_seq_delete_kernel_client()
        port_free(): drain input
          snd_opl3_synth_free_port()
            free opl3->chset
                                       snd_opl3_timer_func()
                                         lock(voice_lock)
                                         note_off == jiffies
                                         snd_opl3_note_off_unsafe()
                                           read voice->chan->number

The timer can thus read a channel from the freed set. Shut it down
synchronously before freeing chset, outside voice_lock and
sys_timer_lock, which the callback needs. Shutdown also prevents a
callback from rearming the timer during teardown. Clear the delayed-note
flags under voice_lock so the timer reinitialization on rebind cannot
revive old channel accesses.

Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>

---

diff --git a/sound/drivers/opl3/opl3_seq.c b/sound/drivers/opl3/opl3_seq.c
index b77d8e8f12fb9f90ac72b9209f4f59373eadf6f4..86bf2680a3b5e2ffee73b59a9056f93fb2bec891 100644
--- a/sound/drivers/opl3/opl3_seq.c
+++ b/sound/drivers/opl3/opl3_seq.c
@@ -151,7 +151,14 @@ static int snd_opl3_synth_event_input(struct snd_seq_event * ev, int direct,
 static void snd_opl3_synth_free_port(void *private_data)
 {
 	struct snd_opl3 *opl3 = private_data;
+	int i;
 
+	timer_shutdown_sync(&opl3->tlist);
+	/* Discard delayed notes before reusing the timer on rebind. */
+	scoped_guard(spinlock_irqsave, &opl3->voice_lock) {
+		for (i = 0; i < MAX_OPL3_VOICES; i++)
+			opl3->voices[i].note_off_check = 0;
+	}
 	snd_midi_channel_free_set(opl3->chset);
 }
 

Re: [PATCH] ALSA: opl3: Stop delayed note-offs before freeing the channel set

[Takashi Iwai]

On Mon, 19 Oct 2026 12:15:12 +0200,
Cen Zhang wrote:
> 
> An in-tree OPL3 device accepts FM instruments through its hwdep write
> interface. Loading a bank-127 instrument with nonzero fix_dur and sending
> a direct NOTEON without a subscription leaves the device in its initial
> SYNTH mode. snd_opl3_note_on() sets the note_off deadline, starts tlist
> at the next jiffy and stores the channel pointer in a voice.
> 
> Unbinding the OPL3 sequencer device can then free the port's channel set
> while the card-owned OPL3 object and its timer remain alive. Port removal
> drains event_input users, but the timer is independent. Without a
> subscription, no unuse callback runs to perform its timer cleanup:
> 
>   NOTEON / sequencer-device unbind      Delayed-note timer
>   -------------------------------      ------------------
>   snd_opl3_note_on()
>     lock(voice_lock)
>     set voice->note_off deadline
>     snd_opl3_start_timer()
>       mod_timer(tlist, jiffies + 1)
>     voice->note_off_check = 1
>     voice->chan = channel
>     unlock(voice_lock)
>   NOTEON returns
>   sysfs driver unbind
>     snd_opl3_seq_remove()
>       snd_seq_delete_kernel_client()
>         port_free(): drain input
>           snd_opl3_synth_free_port()
>             free opl3->chset
>                                        snd_opl3_timer_func()
>                                          lock(voice_lock)
>                                          note_off == jiffies
>                                          snd_opl3_note_off_unsafe()
>                                            read voice->chan->number
> 
> The timer can thus read a channel from the freed set. Shut it down
> synchronously before freeing chset, outside voice_lock and
> sys_timer_lock, which the callback needs. Shutdown also prevents a
> callback from rearming the timer during teardown. Clear the delayed-note
> flags under voice_lock so the timer reinitialization on rebind cannot
> revive old channel accesses.
> 
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
> 
> ---
> 
> diff --git a/sound/drivers/opl3/opl3_seq.c b/sound/drivers/opl3/opl3_seq.c
> index b77d8e8f12fb9f90ac72b9209f4f59373eadf6f4..86bf2680a3b5e2ffee73b59a9056f93fb2bec891 100644
> --- a/sound/drivers/opl3/opl3_seq.c
> +++ b/sound/drivers/opl3/opl3_seq.c
> @@ -151,7 +151,14 @@ static int snd_opl3_synth_event_input(struct snd_seq_event * ev, int direct,
>  static void snd_opl3_synth_free_port(void *private_data)
>  {
>  	struct snd_opl3 *opl3 = private_data;
> +	int i;
>  
> +	timer_shutdown_sync(&opl3->tlist);
> +	/* Discard delayed notes before reusing the timer on rebind. */
> +	scoped_guard(spinlock_irqsave, &opl3->voice_lock) {
> +		for (i = 0; i < MAX_OPL3_VOICES; i++)
> +			opl3->voices[i].note_off_check = 0;
> +	}
>  	snd_midi_channel_free_set(opl3->chset);
>  }
>  

Some issues have been reported by Sashiko.  Could you check them?
  https://sashiko.dev/#/patchset/pm-pmb-4552c4e605507d8d9b16-v4-213af356c0046331c8ff%40gmail.com


thanks,

Takashi