From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Takashi Iwai <tiwai@suse.de>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.6.y 4/5] ALSA: synth: Use guard() for spin locks
Date: Tue, 10 Nov 2026 18:12:34 -0500 [thread overview]
Message-ID: <20261110231146.73238-4-sashal@kernel.org> (raw)
In-Reply-To: <20261110231146.73238-1-sashal@kernel.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 59ede7178d402b3bfa0266cbd9ad348d5612c295 ]
Clean up the code using guard() for spin locks.
Merely code refactoring, and no behavior change.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250829151335.7342-5-tiwai@suse.de
Stable-dep-of: 34e3e04b8a17 ("ALSA: emux: Fix UAF of soundfont zones at note-on")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/synth/emux/emux_effect.c | 29 ++++++++--------
sound/synth/emux/emux_synth.c | 54 +++++++----------------------
sound/synth/emux/soundfont.c | 63 ++++++++++++----------------------
3 files changed, 49 insertions(+), 97 deletions(-)
diff --git a/sound/synth/emux/emux_effect.c b/sound/synth/emux/emux_effect.c
index 3c7314f5fb19c..bfe383fa90ba1 100644
--- a/sound/synth/emux/emux_effect.c
+++ b/sound/synth/emux/emux_effect.c
@@ -168,7 +168,6 @@ snd_emux_send_effect(struct snd_emux_port *port, struct snd_midi_channel *chan,
unsigned char *srcp, *origp;
struct snd_emux *emu;
struct snd_emux_effect_table *fx;
- unsigned long flags;
emu = port->emu;
fx = chan->private;
@@ -195,22 +194,22 @@ snd_emux_send_effect(struct snd_emux_port *port, struct snd_midi_channel *chan,
offset++;
#endif
/* modify the register values */
- spin_lock_irqsave(&emu->voice_lock, flags);
- for (i = 0; i < emu->max_voices; i++) {
- struct snd_emux_voice *vp = &emu->voices[i];
- if (!STATE_IS_PLAYING(vp->state) || vp->chan != chan)
- continue;
- srcp = (unsigned char*)&vp->reg.parm + offset;
- origp = (unsigned char*)&vp->zone->v.parm + offset;
- if (parm_defs[i].type & PARM_IS_BYTE) {
- *srcp = *origp;
- effect_set_byte(srcp, chan, type);
- } else {
- *(unsigned short*)srcp = *(unsigned short*)origp;
- effect_set_word((unsigned short*)srcp, chan, type);
+ scoped_guard(spinlock_irqsave, &emu->voice_lock) {
+ for (i = 0; i < emu->max_voices; i++) {
+ struct snd_emux_voice *vp = &emu->voices[i];
+ if (!STATE_IS_PLAYING(vp->state) || vp->chan != chan)
+ continue;
+ srcp = (unsigned char *)&vp->reg.parm + offset;
+ origp = (unsigned char *)&vp->zone->v.parm + offset;
+ if (parm_defs[i].type & PARM_IS_BYTE) {
+ *srcp = *origp;
+ effect_set_byte(srcp, chan, type);
+ } else {
+ *(unsigned short *)srcp = *(unsigned short *)origp;
+ effect_set_word((unsigned short *)srcp, chan, type);
+ }
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
/* activate them */
snd_emux_update_channel(port, chan, parm_defs[type].update);
diff --git a/sound/synth/emux/emux_synth.c b/sound/synth/emux/emux_synth.c
index 02e2c69d7f18e..b3c8296840a56 100644
--- a/sound/synth/emux/emux_synth.c
+++ b/sound/synth/emux/emux_synth.c
@@ -49,7 +49,6 @@ snd_emux_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
int i, key, nvoices;
struct snd_emux_voice *vp;
struct snd_sf_zone *table[SNDRV_EMUX_MAX_MULTI_VOICES];
- unsigned long flags;
struct snd_emux_port *port;
port = p;
@@ -77,7 +76,7 @@ snd_emux_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
terminate_note1(emu, key, chan, 0);
#endif
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < nvoices; i++) {
/* set up each voice parameter */
@@ -124,7 +123,6 @@ snd_emux_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
vp->ontime = jiffies; /* remember the trigger timing */
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
#ifdef SNDRV_EMUX_USE_RAW_EFFECT
if (port->port_mode == SNDRV_EMUX_PORT_MODE_OSS_SYNTH) {
@@ -147,7 +145,6 @@ snd_emux_note_off(void *p, int note, int vel, struct snd_midi_channel *chan)
int ch;
struct snd_emux *emu;
struct snd_emux_voice *vp;
- unsigned long flags;
struct snd_emux_port *port;
port = p;
@@ -158,7 +155,7 @@ snd_emux_note_off(void *p, int note, int vel, struct snd_midi_channel *chan)
if (snd_BUG_ON(!emu || !emu->ops.release))
return;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (ch = 0; ch < emu->max_voices; ch++) {
vp = &emu->voices[ch];
if (STATE_IS_PLAYING(vp->state) &&
@@ -180,7 +177,6 @@ snd_emux_note_off(void *p, int note, int vel, struct snd_midi_channel *chan)
emu->ops.release(vp);
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
/*
@@ -192,10 +188,9 @@ void snd_emux_timer_callback(struct timer_list *t)
{
struct snd_emux *emu = from_timer(emu, t, tlist);
struct snd_emux_voice *vp;
- unsigned long flags;
int ch, do_again = 0;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (ch = 0; ch < emu->max_voices; ch++) {
vp = &emu->voices[ch];
if (vp->state == SNDRV_EMUX_ST_PENDING) {
@@ -212,7 +207,6 @@ void snd_emux_timer_callback(struct timer_list *t)
emu->timer_active = 1;
} else
emu->timer_active = 0;
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
/*
@@ -224,7 +218,6 @@ snd_emux_key_press(void *p, int note, int vel, struct snd_midi_channel *chan)
int ch;
struct snd_emux *emu;
struct snd_emux_voice *vp;
- unsigned long flags;
struct snd_emux_port *port;
port = p;
@@ -235,7 +228,7 @@ snd_emux_key_press(void *p, int note, int vel, struct snd_midi_channel *chan)
if (snd_BUG_ON(!emu || !emu->ops.update))
return;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (ch = 0; ch < emu->max_voices; ch++) {
vp = &emu->voices[ch];
if (vp->state == SNDRV_EMUX_ST_ON &&
@@ -244,7 +237,6 @@ snd_emux_key_press(void *p, int note, int vel, struct snd_midi_channel *chan)
update_voice(emu, vp, SNDRV_EMUX_UPDATE_VOLUME);
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
@@ -257,7 +249,6 @@ snd_emux_update_channel(struct snd_emux_port *port, struct snd_midi_channel *cha
struct snd_emux *emu;
struct snd_emux_voice *vp;
int i;
- unsigned long flags;
if (! update)
return;
@@ -266,13 +257,12 @@ snd_emux_update_channel(struct snd_emux_port *port, struct snd_midi_channel *cha
if (snd_BUG_ON(!emu || !emu->ops.update))
return;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (vp->chan == chan)
update_voice(emu, vp, update);
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
/*
@@ -284,7 +274,6 @@ snd_emux_update_port(struct snd_emux_port *port, int update)
struct snd_emux *emu;
struct snd_emux_voice *vp;
int i;
- unsigned long flags;
if (! update)
return;
@@ -293,13 +282,12 @@ snd_emux_update_port(struct snd_emux_port *port, int update)
if (snd_BUG_ON(!emu || !emu->ops.update))
return;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (vp->port == port)
update_voice(emu, vp, update);
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
@@ -365,16 +353,14 @@ terminate_note1(struct snd_emux *emu, int note, struct snd_midi_channel *chan, i
{
int i;
struct snd_emux_voice *vp;
- unsigned long flags;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (STATE_IS_PLAYING(vp->state) && vp->chan == chan &&
vp->key == note)
terminate_voice(emu, vp, free);
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
@@ -407,9 +393,8 @@ snd_emux_terminate_all(struct snd_emux *emu)
{
int i;
struct snd_emux_voice *vp;
- unsigned long flags;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (STATE_IS_PLAYING(vp->state))
@@ -424,7 +409,6 @@ snd_emux_terminate_all(struct snd_emux *emu)
}
/* initialize allocation time */
emu->use_time = 0;
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
EXPORT_SYMBOL(snd_emux_terminate_all);
@@ -438,7 +422,6 @@ snd_emux_sounds_off_all(struct snd_emux_port *port)
int i;
struct snd_emux *emu;
struct snd_emux_voice *vp;
- unsigned long flags;
if (snd_BUG_ON(!port))
return;
@@ -446,7 +429,7 @@ snd_emux_sounds_off_all(struct snd_emux_port *port)
if (snd_BUG_ON(!emu || !emu->ops.terminate))
return;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (STATE_IS_PLAYING(vp->state) &&
@@ -459,7 +442,6 @@ snd_emux_sounds_off_all(struct snd_emux_port *port)
emu->ops.reset(emu, i);
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
@@ -472,9 +454,8 @@ exclusive_note_off(struct snd_emux *emu, struct snd_emux_port *port, int exclass
{
struct snd_emux_voice *vp;
int i;
- unsigned long flags;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (STATE_IS_PLAYING(vp->state) && vp->port == port &&
@@ -482,7 +463,6 @@ exclusive_note_off(struct snd_emux *emu, struct snd_emux_port *port, int exclass
terminate_voice(emu, vp, 0);
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
/*
@@ -916,9 +896,8 @@ snd_emux_init_voices(struct snd_emux *emu)
{
struct snd_emux_voice *vp;
int i;
- unsigned long flags;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
vp->ch = -1; /* not used */
@@ -929,23 +908,19 @@ snd_emux_init_voices(struct snd_emux *emu)
vp->emu = emu;
vp->hw = emu->hw;
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
/*
*/
void snd_emux_lock_voice(struct snd_emux *emu, int voice)
{
- unsigned long flags;
-
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
if (emu->voices[voice].state == SNDRV_EMUX_ST_OFF)
emu->voices[voice].state = SNDRV_EMUX_ST_LOCKED;
else
dev_warn(emu->card->dev,
"invalid voice for lock %d (state = %x)\n",
voice, emu->voices[voice].state);
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
EXPORT_SYMBOL(snd_emux_lock_voice);
@@ -954,16 +929,13 @@ EXPORT_SYMBOL(snd_emux_lock_voice);
*/
void snd_emux_unlock_voice(struct snd_emux *emu, int voice)
{
- unsigned long flags;
-
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
if (emu->voices[voice].state == SNDRV_EMUX_ST_LOCKED)
emu->voices[voice].state = SNDRV_EMUX_ST_OFF;
else
dev_warn(emu->card->dev,
"invalid voice for unlock %d (state = %x)\n",
voice, emu->voices[voice].state);
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
EXPORT_SYMBOL(snd_emux_unlock_voice);
diff --git a/sound/synth/emux/soundfont.c b/sound/synth/emux/soundfont.c
index 03f70cceb4a86..c124d6c27a945 100644
--- a/sound/synth/emux/soundfont.c
+++ b/sound/synth/emux/soundfont.c
@@ -66,11 +66,9 @@ static void snd_sf_clear(struct snd_sf_list *sflist);
static void
lock_preset(struct snd_sf_list *sflist)
{
- unsigned long flags;
mutex_lock(&sflist->presets_mutex);
- spin_lock_irqsave(&sflist->lock, flags);
+ guard(spinlock_irqsave)(&sflist->lock);
sflist->presets_locked = 1;
- spin_unlock_irqrestore(&sflist->lock, flags);
}
@@ -80,10 +78,8 @@ lock_preset(struct snd_sf_list *sflist)
static void
unlock_preset(struct snd_sf_list *sflist)
{
- unsigned long flags;
- spin_lock_irqsave(&sflist->lock, flags);
+ guard(spinlock_irqsave)(&sflist->lock);
sflist->presets_locked = 0;
- spin_unlock_irqrestore(&sflist->lock, flags);
mutex_unlock(&sflist->presets_mutex);
}
@@ -94,14 +90,11 @@ unlock_preset(struct snd_sf_list *sflist)
int
snd_soundfont_close_check(struct snd_sf_list *sflist, int client)
{
- unsigned long flags;
- spin_lock_irqsave(&sflist->lock, flags);
- if (sflist->open_client == client) {
- spin_unlock_irqrestore(&sflist->lock, flags);
- return close_patch(sflist);
+ scoped_guard(spinlock_irqsave, &sflist->lock) {
+ if (sflist->open_client != client)
+ return 0;
}
- spin_unlock_irqrestore(&sflist->lock, flags);
- return 0;
+ return close_patch(sflist);
}
@@ -119,7 +112,6 @@ snd_soundfont_load(struct snd_card *card,
long count, int client)
{
struct soundfont_patch_info patch;
- unsigned long flags;
int rc;
if (count < (long)sizeof(patch)) {
@@ -155,12 +147,10 @@ snd_soundfont_load(struct snd_card *card,
}
/* check if other client already opened patch */
- spin_lock_irqsave(&sflist->lock, flags);
- if (sflist->open_client != client) {
- spin_unlock_irqrestore(&sflist->lock, flags);
- return -EBUSY;
+ scoped_guard(spinlock_irqsave, &sflist->lock) {
+ if (sflist->open_client != client)
+ return -EBUSY;
}
- spin_unlock_irqrestore(&sflist->lock, flags);
lock_preset(sflist);
rc = -EINVAL;
@@ -223,14 +213,11 @@ open_patch(struct snd_sf_list *sflist, const char __user *data,
{
struct soundfont_open_parm parm;
struct snd_soundfont *sf;
- unsigned long flags;
- spin_lock_irqsave(&sflist->lock, flags);
- if (sflist->open_client >= 0 || sflist->currsf) {
- spin_unlock_irqrestore(&sflist->lock, flags);
- return -EBUSY;
+ scoped_guard(spinlock_irqsave, &sflist->lock) {
+ if (sflist->open_client >= 0 || sflist->currsf)
+ return -EBUSY;
}
- spin_unlock_irqrestore(&sflist->lock, flags);
if (copy_from_user(&parm, data, sizeof(parm)))
return -EFAULT;
@@ -244,10 +231,10 @@ open_patch(struct snd_sf_list *sflist, const char __user *data,
return -ENOMEM;
}
- spin_lock_irqsave(&sflist->lock, flags);
- sflist->open_client = client;
- sflist->currsf = sf;
- spin_unlock_irqrestore(&sflist->lock, flags);
+ scoped_guard(spinlock_irqsave, &sflist->lock) {
+ sflist->open_client = client;
+ sflist->currsf = sf;
+ }
return 0;
}
@@ -305,12 +292,10 @@ is_identical_font(struct snd_soundfont *sf, int type, unsigned char *name)
static int
close_patch(struct snd_sf_list *sflist)
{
- unsigned long flags;
-
- spin_lock_irqsave(&sflist->lock, flags);
- sflist->currsf = NULL;
- sflist->open_client = -1;
- spin_unlock_irqrestore(&sflist->lock, flags);
+ scoped_guard(spinlock_irqsave, &sflist->lock) {
+ sflist->currsf = NULL;
+ sflist->open_client = -1;
+ }
rebuild_presets(sflist);
@@ -1243,17 +1228,14 @@ snd_soundfont_search_zone(struct snd_sf_list *sflist, int *notep, int vel,
struct snd_sf_zone **table, int max_layers)
{
int nvoices;
- unsigned long flags;
/* this function is supposed to be called atomically,
* so we check the lock. if it's busy, just returns 0 to
* tell the caller the busy state
*/
- spin_lock_irqsave(&sflist->lock, flags);
- if (sflist->presets_locked) {
- spin_unlock_irqrestore(&sflist->lock, flags);
+ guard(spinlock_irqsave)(&sflist->lock);
+ if (sflist->presets_locked)
return 0;
- }
nvoices = search_zones(sflist, notep, vel, preset, bank,
table, max_layers, 0);
if (! nvoices) {
@@ -1262,7 +1244,6 @@ snd_soundfont_search_zone(struct snd_sf_list *sflist, int *notep, int vel,
def_preset, def_bank,
table, max_layers, 0);
}
- spin_unlock_irqrestore(&sflist->lock, flags);
return nvoices;
}
--
2.53.0
next prev parent reply other threads:[~2026-11-10 23:12 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-07 10:37 FAILED: patch "[PATCH] ALSA: emux: Fix UAF of soundfont zones at note-on" failed to apply to 6.6-stable tree Sasha Levin
2026-11-10 23:12 ` [PATCH 6.6.y 1/5] ALSA: emux: prune unused parameter from snd_soundfont_load_guspatch() Sasha Levin
2026-11-10 23:12 ` [PATCH 6.6.y 2/5] ALSA: emux: fix validation of snd_emux.num_ports Sasha Levin
2026-11-10 23:12 ` [PATCH 6.6.y 3/5] ALSA: emux: Use standard print API Sasha Levin
2026-11-10 23:12 ` Sasha Levin [this message]
2026-11-10 23:12 ` [PATCH 6.6.y 5/5] ALSA: emux: Fix UAF of soundfont zones at note-on Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261110231146.73238-4-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.