Re: [PATCH] ALSA: dummy: Refresh the CD capture switch before use

[Takashi Iwai <tiwai@suse.de>]

On Fri, 16 Oct 2026 14:50:04 +0200,
Cen Zhang wrote:
> 
> Hi Takashi,
> 
> Takashi Iwai <tiwai@suse.de> 于2026年10月16日周五 19:49写道：
> >
> > On Fri, 16 Oct 2026 04:01:10 +0200,
> > Cen Zhang wrote:
> > >
> > > The CD Capture Switch control must remain live while
> > > snd_dummy_iobox_put() updates its access flags and uses its ID for
> > > notification. snd_card_dummy_new_mixer() caches the control pointer, but
> > > snd_ctl_remove_id() can unlink and free it without updating that cache.
> > >
> > > This requires a kernel caller to remove the switch while the dummy card
> > > stays connected and External I/O Box remains writable. Userspace
> > > ELEM_REMOVE rejects this driver control because it lacks
> > > SNDRV_CTL_ELEM_ACCESS_USER.
> >
> > So, the removal shouldn't happen, but...
> >
> > > With I/O Box initially 1 and CD Volume still
> > > present, the following ordered sequence is possible:
> > >
> > >   1. snd_ctl_remove_id() takes controls_rwsem for write, finds and
> > >      unlinks CD Capture Switch, sends removal notifications and calls
> > >      snd_ctl_free_one(), then drops the semaphore and returns.
> >
> > ... how this happens at all?  Unless 1 really happens, the rest are
> > fictional dreams.
> >
> > The same for another dummy driver patch.  Does it really happen at
> > all?
> >
> >
> > thanks,
> >
> > Takashi
> 
> Thanks very much for the review. You're right. It is AI obfuscation.
> After carefully checking the code myself, I could not find a real path
> that removes them.
> 
> I'm very, very sorry for this noise. Please disregard both patches.
> I'll be much more careful in the future.

Don't worry, your patches have been appreciated.

But, I guess that we can ask the model to provide a PoC code for
triggering the bug, at least for the case like dummy driver, and
verify the actual crash?  This would show more clearly whether it's a
real issue or not.


thanks,

Takashi