Re: [PATCH v2] ALSA: pcm: Unlink substreams before releasing them

[Takashi Iwai]

On Thu, 15 Oct 2026 17:35:30 +0200,
Cen Zhang wrote:
> 
> Hi Takashi,
> 
> Takashi Iwai <tiwai@xxxxxxx> 于2026年10月15日周四 15:18写道：
> >
> > The patch I submitted yesterday is such an attempt:
> >   https://lore.kernel.org/20261014141212.316223-1-tiwai@xxxxxxx
> >
> > Unfortunately it couldn't be reviewed by Sashiko, as it's based on my
> > latest tree.  And now I noticed that there is still a potential race,
> > and fixed now.  Will resubmit v2 patch.
> >
> >
> > thanks,
> >
> > Takashi
> 
> After read the v2 patch. I also have a minor concern: is there still a
> lifetime window between snd_refcount_put() and snd_refcount_sync()?
> 
> 
> Suppose drain(A) has pinned B's runtime, and close(B) has completed
> unlink and drop. Could the following happen on two CPUs?
> 
>   drain(A)                         close(B)
>   --------                         --------
>   finish_wait(&rt->sleep, &wait);
>   snd_refcount_put(&rt->refcnt):
>     decrement count to zero
>                                    snd_refcount_sync(&rt->refcnt);
>                                      /* sees zero and returns */
>                                    ...
>                                    snd_pcm_detach_substream(B);
>                                      kfree(rt);
>     wake_up(&rt->refcnt.waiter);
> 
> Here rt is B's runtime. Since wait_event() can return on its initial
> condition check, could the final wake_up() access the embedded
> waitqueue after rt has been freed? A holds its own stream lock at
> this point, while B has already been unlinked.

Yes, and it's covered by another patch:
  https://lore.kernel.org/20261015112256.3902-1-tiwai@xxxxxxx


thanks,

Takashi