[PATCH] ASoC: soc-compress: Fix race condition in soc_compr_open_fe

[PATCH] ASoC: soc-compress: Fix race condition in soc_compr_open_fe

[이승빈]

Hello Maintainers, Takashi and Jaroslav,

I am writing to respectfully follow up on a patch I submitted to the alsa-devel mailing list and Patchwork

I would like to bring up an important issue regarding the interaction between soc_compr_trigger_fe and snd_soc_dpcm_runtime_update.

If the soc_compr_trigger_fe function is called during the execution of snd_soc_dpcm_runtime_update, it may lead to unintended
modification of the FE's DPCM runtime update variable. As a result, the BE list associated with the FE could become detached,
preventing proper closure of the BE.

Ex)When repeatedly switching between deep playback and offload playback during MP3 playback

To prevent this race condition, access to this critical section should be protected using snd_soc_dpcm_mutex_lock. Ensuring mutual
exclusion during these operations will maintain the integrity of the BE list and avoid potential resource leaks.

I understand that you have a large backlog of patches to review. If you have had a chance to look at it and found any issues, or if
there's anything I need to fix or clarify, please let me know. I would be happy to prepare a v2 version if necessary.

Thank you very much for your time and attention to this matter.

Best regards,

Change-Id: Ibfd1712e6baf41a30afa357a91ada83d205f968b
Signed-off-by: Seungbin Lee <seungbin.lee@samsung.com>
---
 sound/soc/soc-compress.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index fc8db54352541..1a2a3fe6a2340 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -286,6 +286,8 @@ static int soc_compr_trigger_fe(struct snd_compr_stream *cstream, int cmd)
 
 	snd_soc_card_mutex_lock(fe->card);
 
+	snd_soc_dpcm_mutex_lock(fe);
+
 	ret = snd_soc_dai_compr_trigger(cpu_dai, cstream, cmd);
 	if (ret < 0)
 		goto out;
@@ -315,6 +317,8 @@ static int soc_compr_trigger_fe(struct snd_compr_stream *cstream, int cmd)
 
 out:
 	fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+	snd_soc_dpcm_mutex_unlock(fe);
+
 	snd_soc_card_mutex_unlock(fe->card);
 	return ret;
 }
-- 
2.34.1

[PATCH] ASoC: soc-compress: Fix race condition in soc_compr_open_fe

[이승빈]

From: Seungbin Lee <seungbin.lee@samsung.com>
Date: Wed, 18 Jun 2025 13:33:02 +0900
Subject: [PATCH] ASoC: soc-compress: Fix race condition in soc_compr_open_fe

If the soc_compr_trigger_fe function is called during snd_soc_dpcm_runtime_update execution,
the FE's DPCM runtime update variable may be changed.
Then the BE list connected to the FE flies away, and the BE cannot be closed.

This needs to be protected by the snd_soc_dpcm_mutex_lock.

Change-Id: Ibfd1712e6baf41a30afa357a91ada83d205f968b
Signed-off-by: Seungbin Lee <seungbin.lee@samsung.com>
---
 sound/soc/soc-compress.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index fc8db54352541..1a2a3fe6a2340 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -286,6 +286,8 @@ static int soc_compr_trigger_fe(struct snd_compr_stream *cstream, int cmd)
 
 	snd_soc_card_mutex_lock(fe->card);
 
+	snd_soc_dpcm_mutex_lock(fe);
+
 	ret = snd_soc_dai_compr_trigger(cpu_dai, cstream, cmd);
 	if (ret < 0)
 		goto out;
@@ -315,6 +317,8 @@ static int soc_compr_trigger_fe(struct snd_compr_stream *cstream, int cmd)
 
 out:
 	fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+	snd_soc_dpcm_mutex_unlock(fe);
+
 	snd_soc_card_mutex_unlock(fe->card);
 	return ret;
 }
-- 
2.34.1

RE: [PATCH] ASoC: soc-compress: Fix race condition in soc_compr_open_fe

[이승빈]

I am sending it again after changing it to plain text mail.

Thanks

From: 이승빈 <seungbin.lee@samsung.com> 
Sent: Monday, June 23, 2025 10:31 AM
To: 'alsa-devel@alsa-project.org' <alsa-devel@alsa-project.org>; 'linux-sound@vger.kernel.org' <linux-sound@vger.kernel.org>; 'gregkh@linuxfoundation.org' <gregkh@linuxfoundation.org>; 'pierre-louis.bossart@linux.intel.com' <pierre-louis.bossart@linux.intel.com>; 'perex@perex.cz' <perex@perex.cz>; 'tiwai@suse.de' <tiwai@suse.de>
Cc: 'pilsun.jang@samsung.com' <pilsun.jang@samsung.com>; 's47.kang@samsung.com' <s47.kang@samsung.com>; 'donghee.moon@samsung.com' <donghee.moon@samsung.com>
Subject: FW: [PATCH] ASoC: soc-compress: Fix race condition in soc_compr_open_fe

Add recipient addition and modification patch to the body of the transmission.

From: 이승빈 <mailto:seungbin.lee@samsung.com> 
Sent: Thursday, June 19, 2025 10:25 AM
To: 'tiwai@suse.de' <mailto:tiwai@suse.de>
Subject: [PATCH] ASoC: soc-compress: Fix race condition in soc_compr_open_fe

Hi

I am sending this email to report an issue found in sound/soc/soc-compress.c.

Scenario: Playing a mix of MP3 and WAV files repeatedly from YouTube Music by pressing "next".

Issue occurs when snd_soc_dpcm_runtime_update is called and soc_compr_trigger_fe is invoked, causing the value of “fe->dpcm[stream].runtime_update” to change mid-process. This results in a problem where, during the closing of the BE connected to the FE in snd_soc_dpcm_runtime_update, only the entry is removed from the list without actually being closed.

The attached patch resolves this issue as confirmed through testing.

Additionally, while performing DPCM related operations in soc-compress.c, snd_soc_dpcm_mutex_lock is used; however, soc_compr_trigger_fe does not have this lock. Please review the attached patch regarding this matter.

Thank you.

From 72a0340bf7dccc6f53dc2d02e04bb3f894d796e3 Mon Sep 17 00:00:00 2001
From: Seungbin Lee <mailto:seungbin.lee@samsung.com>
Date: Wed, 18 Jun 2025 13:33:02 +0900
Subject: [PATCH] ASoC: soc-compress: Fix race condition in soc_compr_open_fe

If the soc_compr_trigger_fe function is called during snd_soc_dpcm_runtime_update execution,
the FE's DPCM runtime update variable may be changed.
Then the BE list connected to the FE flies away, and the BE cannot be closed.

This needs to be protected by the snd_soc_dpcm_mutex_lock.

Change-Id: Ibfd1712e6baf41a30afa357a91ada83d205f968b
Signed-off-by: Seungbin Lee <mailto:seungbin.lee@samsung.com>
---
sound/soc/soc-compress.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index fc8db54352541..1a2a3fe6a2340 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -286,6 +286,8 @@ static int soc_compr_trigger_fe(struct snd_compr_stream *cstream, int cmd)

           snd_soc_card_mutex_lock(fe->card);

+         snd_soc_dpcm_mutex_lock(fe);
+
          ret = snd_soc_dai_compr_trigger(cpu_dai, cstream, cmd);
          if (ret < 0)
                    goto out;
@@ -315,6 +317,8 @@ static int soc_compr_trigger_fe(struct snd_compr_stream *cstream, int cmd)

 out:
          fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+         snd_soc_dpcm_mutex_unlock(fe);
+
          snd_soc_card_mutex_unlock(fe->card);
          return ret;
}
-- 
2.34.1