ALSA: PCM: Fix some races at disconnection

Fix races at PCM disconnection:
- while a PCM device is being opened or closed
- while the PCM state is being changed without lock in prepare,
  hw_params, hw_free ops

Reported-by: Matthieu CASTET <matthieu.castet@parrot.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

1 files changed, 6 insertions, 1 deletions

diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index f2991940b271..993b2405fdfe 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -1086,11 +1086,15 @@ static int snd_pcm_dev_disconnect(struct snd_device *device)
         if (list_empty(&pcm->list))
                 goto unlock;
 
+        mutex_lock(&pcm->open_mutex);
         list_del_init(&pcm->list);
         for (cidx = 0; cidx < 2; cidx++)
-                for (substream = pcm->streams[cidx].substream; substream; substream = substream->next)
+                for (substream = pcm->streams[cidx].substream; substream; substream = substream->next) {
+                        snd_pcm_stream_lock_irq(substream);
                         if (substream->runtime)
                                 substream->runtime->status->state = SNDRV_PCM_STATE_DISCONNECTED;
+                        snd_pcm_stream_unlock_irq(substream);
+                }
         list_for_each_entry(notify, &snd_pcm_notify_list, list) {
                 notify->n_disconnect(pcm);
         }
@@ -1110,6 +1114,7 @@ static int snd_pcm_dev_disconnect(struct snd_device *device)
                         pcm->streams[cidx].chmap_kctl = NULL;
                 }
         }
+        mutex_unlock(&pcm->open_mutex);
  unlock:
         mutex_unlock(&register_mutex);
         return 0;