Re: [PATCH] ALSA: pcm: oss: Serialize final setup list cleanup

[Cen Zhang]

Hi Takashi,

>
> How can this happen?  The PCM proc file belongs to the card, and
> snd_oss_proc_done() is called from snd_pcm_free() at the card removal,
> where all opened descriptors must have been released before reaching
> this point and no new open is allowed any longer.
>
>
> thanks,
>
> Takashi

The whole-card removal waits for the open files but the reported
case used codec-only sysfs unbind while the card remained registered:

  /sys/bus/hdaudio/drivers/snd_hda_codec_generic/unbind

The OSS open reaches snd_pcm_oss_look_for_setup() before acquiring
pcm->open_mutex and before azx_pcm_open() takes the codec PCM reference.
The card reference therefore does not make this early lookup visible
to the codec's snd_refcount_sync().

The original report came from a controlled QEMU run with scheduling
instrumentation. The teardown used the normal sysfs unbind path, and
the recorded free stack included:

  snd_pcm_oss_proc_free_setup_list()
  snd_pcm_oss_unregister_minor()
  snd_pcm_free()
  __snd_device_free()
  snd_device_free()
  snd_hda_codec_cleanup_for_unbind()
  hda_codec_driver_remove()
  ...
  unbind_store()

On rechecking the lifetime handling, I found that the added setup_mutex
only protects the setup-list lookup. It does not keep the PCM and codec
resources alive for the remainder of snd_pcm_oss_open(), so it is may not
a complete fix for the codec-unbind race.

Best regards,
Cen Zhang