[PATCH] ALSA: aloop: Keep shared timer callbacks alive through close

[PATCH] ALSA: aloop: Keep shared timer callbacks alive through close

[Cen Zhang]

The shared sound-timer callback must finish using the selected PCM
runtimes before a close can detach them. loopback_snd_timer_period_elapsed()
saves the active substreams under cable->lock, then drops the lock before
calling snd_pcm_period_elapsed() or snd_pcm_stop_xrun(). The sound-timer
backend has no per-stream close drain, and free_cable() keeps the timer
open when the paired endpoint remains attached.

With both directions running on a shared sound timer, playback can be
dropped and closed while a notification is pending. Capture keeps the
timer alive, allowing this order:

  Timer callback                       Playback owner
  --------------                       --------------
  select playback under cable->lock
  unlock; delay notification
                                       DROP; HW_FREE -> OPEN
                                       close: snd_pcm_drop(); unlock
                                       free_cable(); peer stays alive
  snd_pcm_period_elapsed()
    lock stream; cache runtime
                                       snd_pcm_detach_substream()
                                         free runtime and its fasync
    read runtime->fasync

The stream lock taken by snd_pcm_drop() cannot protect a notification
that starts after it returns, and detach does not take it. The callback
can therefore read runtime->fasync after the runtime has been freed, and
an escaped notification can also reach a replacement runtime if the same
substream slot is reopened before the notification resumes.

Take the existing cable->stop_count reference under cable->lock when
selecting the targets and release it after the PCM callbacks finish,
including the XRUN path. free_cable() already removes the closing
endpoint under that lock and waits for stop_count before returning, so
runtime detach and slot reuse cannot overtake the notification.

Fixes: 26c53379f98d ("ALSA: aloop: Support selection of snd_timer instead of jiffies")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Assisted-by: LLM

---

diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index 0aaa64b189daef377f080a63665a9be9036e9d9c..39710389f6243ef1fb8018fa4990c22d382a21b0 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -100,7 +100,7 @@ struct loopback_ops {
 struct loopback_cable {
 	spinlock_t lock;
 	struct loopback_pcm *streams[2];
-	/* in-flight peer stops running outside cable->lock */
+	/* in-flight PCM callbacks running outside cable->lock */
 	struct snd_refcount stop_count;
 	struct snd_pcm_hardware hw;
 	/* flags */
@@ -873,6 +873,8 @@ static void loopback_snd_timer_period_elapsed(struct loopback_cable *cable,
 		valid_runtime = (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) ?
 			dpcm_play->substream->runtime :
 			dpcm_capt->substream->runtime;
+		/* Keep runtimes alive through the PCM callbacks. */
+		snd_refcount_get(&cable->stop_count);
 
 		/* resolution is only valid for SNDRV_TIMER_EVENT_TICK events */
 		if (event == SNDRV_TIMER_EVENT_TICK) {
@@ -908,13 +910,16 @@ static void loopback_snd_timer_period_elapsed(struct loopback_cable *cable,
 			snd_pcm_stop_xrun(substream_play);
 		if (substream_capt)
 			snd_pcm_stop_xrun(substream_capt);
-		return;
+		goto exit;
 	}
 
 	if (substream_play)
 		snd_pcm_period_elapsed(substream_play);
 	if (substream_capt)
 		snd_pcm_period_elapsed(substream_capt);
+
+exit:
+	snd_refcount_put(&cable->stop_count);
 }
 
 static void loopback_snd_timer_function(struct snd_timer_instance *timeri,
@@ -1174,7 +1179,7 @@ static void free_cable(struct snd_pcm_substream *substream)
 		other_alive = cable->streams[!substream->stream];
 	}
 
-	/* Pair with the stop_count increment in loopback_check_format(). */
+	/* Wait for PCM callbacks running outside cable->lock. */
 	snd_refcount_sync(&cable->stop_count);
 	if (other_alive)
 		return;

Re: [PATCH] ALSA: aloop: Keep shared timer callbacks alive through close

[Takashi Iwai]

On Mon, 19 Oct 2026 11:05:21 +0200,
Cen Zhang wrote:
> 
> The shared sound-timer callback must finish using the selected PCM
> runtimes before a close can detach them. loopback_snd_timer_period_elapsed()
> saves the active substreams under cable->lock, then drops the lock before
> calling snd_pcm_period_elapsed() or snd_pcm_stop_xrun(). The sound-timer
> backend has no per-stream close drain, and free_cable() keeps the timer
> open when the paired endpoint remains attached.
> 
> With both directions running on a shared sound timer, playback can be
> dropped and closed while a notification is pending. Capture keeps the
> timer alive, allowing this order:
> 
>   Timer callback                       Playback owner
>   --------------                       --------------
>   select playback under cable->lock
>   unlock; delay notification
>                                        DROP; HW_FREE -> OPEN
>                                        close: snd_pcm_drop(); unlock
>                                        free_cable(); peer stays alive
>   snd_pcm_period_elapsed()
>     lock stream; cache runtime
>                                        snd_pcm_detach_substream()
>                                          free runtime and its fasync
>     read runtime->fasync
> 
> The stream lock taken by snd_pcm_drop() cannot protect a notification
> that starts after it returns, and detach does not take it. The callback
> can therefore read runtime->fasync after the runtime has been freed, and
> an escaped notification can also reach a replacement runtime if the same
> substream slot is reopened before the notification resumes.
> 
> Take the existing cable->stop_count reference under cable->lock when
> selecting the targets and release it after the PCM callbacks finish,
> including the XRUN path. free_cable() already removes the closing
> endpoint under that lock and waits for stop_count before returning, so
> runtime detach and slot reuse cannot overtake the notification.
> 
> Fixes: 26c53379f98d ("ALSA: aloop: Support selection of snd_timer instead of jiffies")
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
> Assisted-by: LLM

Applied now.  Thanks.


Takashi