From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794591338; b=wiMLI/7fu8A2SJQCJ2eRbfUNlaObd0yT4H/U8x6fchmqpRA83rAzWloM9u56j0ViuFYZ sFVLKlEs61pYCNKFsV4rZcNedLGQDZXuvjD79EtONsxrDJc75Z6Vk+LadkhyDNbkHxFnR ykeUQsI5bvDvDgfZBq5PoXbzA7Ns3dcYftU9uNK2KrNStV4gFqeLcTr8cPivy2KXbhSK6 5mE+N7sea1cQ7fIHTYfeXmv2vTfqP2iJGB+Uy1+EsSpmD4sGoHmXjkit3p3rL2jxtAP6Y odBO7qbUiV6IJIrCJitkCcOtq07KhYAkHLdIMZXLszLhzN0IHk97pivxcyE+3371shg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794591338; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=JVDp6ByNcJr+lw6fTVHS3yU+owvIQaDGHBMr9QumAYc=; b=pBT5eNyTILO5NrY4SYLQ6u2y67GD8mfFT+5SNkDzowNfu1cZLXLsNRX5z0OzjcDcPngg SFpaUXeW/I37kl64LQx0RxoNUmIkPjEO0gnILRydQX30msdz6ZNTaBL+iIShHZJksuKt1 sbC4v+wsyIcUhqDtqDJi5F+gjImpvc71QCRmCOlccwjVMzCGC+F2Zmm3fVd+/zNVWlvEx vMTKn40g904IHpYVcEcaJqIEgpTm7kxF5c1FvxQJrn/u3OzB++e3BpEOLpEtKw0w/Qqp7 gbe0KIBPS64SjMSDMvhXL3+cxDkCdS5TMCyVUbWMEL0BjgeX1dlcmT1yjr4/3glf9Xg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=QMrJxAYM; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 416DE606B21E; Fri, 13 Nov 2026 17:35:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=QMrJxAYM Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97D871F000C5; Fri, 13 Nov 2026 17:35:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794591337; bh=JVDp6ByNcJr+lw6fTVHS3yU+owvIQaDGHBMr9QumAYc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=QMrJxAYMRT8uBAtjJHvjr+RF/EJUSrc1LQphy0ssGDzSB34/k8cDxRKQ34ySSMU8/ +I8u5t0updeKoCDhZs4483GyDfLL4VNEyYInJHExwLAZximu9OM5lEQC8AMXUJwYyh HURIf0qnEy5E/wjp0wkr/adX5nyBheSx5vHq86Ac= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Runyu Xiao , Takashi Iwai , Sasha Levin Subject: [PATCH 6.12 447/670] ALSA: usb-audio: Protect Roland control activation Date: Fri, 13 Nov 2026 10:50:11 -0500 Message-ID: <20261113153827.065265307@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Runyu Xiao [ Upstream commit 19b42c1fff7f220a6346c614d79ce1bda6d95b40 ] The USB MIDI driver changes the Roland MIDI Input Mode control's access flags directly from the rawmidi open and close paths. These changes are not protected by the ALSA control core and the corresponding notifications can race with control access. Use snd_ctl_activate_id() so that the control core updates the access flags and sends the notification under its lock. Release the USB MIDI mutex before calling it because the control write path holds controls_rwsem while roland_load_put() takes the USB MIDI mutex. Keep the state transition and alternate-setting change under the USB MIDI mutex; rawmidi's open mutex serializes the enclosing open and close paths. Fixes: 96f61d9ade82 ("sound: usb-audio: allow switching altsetting on Roland USB MIDI devices") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Runyu Xiao Link: https://patch.msgid.link/20260929141726.2166899-1-runyu.xiao@seu.edu.cn Signed-off-by: Takashi Iwai [ sashal: Replaced scoped guards with explicit lock/unlock calls while retaining the input-stop condition without keep_input_running. ] Signed-off-by: Sasha Levin --- sound/usb/midi.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index cb9bcfa22afc9..6ac38297c6c59 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1152,7 +1152,9 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir, int open) { struct snd_usb_midi *umidi = substream->rmidi->private_data; - struct snd_kcontrol *ctl; + struct snd_ctl_elem_id ctl_id; + bool activate_ctl = false; + bool active; down_read(&umidi->disc_rwsem); if (umidi->disconnected) { @@ -1164,11 +1166,9 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir, if (open) { if (!umidi->opened[0] && !umidi->opened[1]) { if (umidi->roland_load_ctl) { - ctl = umidi->roland_load_ctl; - ctl->vd[0].access |= - SNDRV_CTL_ELEM_ACCESS_INACTIVE; - snd_ctl_notify(umidi->card, - SNDRV_CTL_EVENT_MASK_INFO, &ctl->id); + ctl_id = umidi->roland_load_ctl->id; + activate_ctl = true; + active = false; update_roland_altsetting(umidi); } } @@ -1181,15 +1181,15 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir, snd_usbmidi_input_stop(&umidi->list); if (!umidi->opened[0] && !umidi->opened[1]) { if (umidi->roland_load_ctl) { - ctl = umidi->roland_load_ctl; - ctl->vd[0].access &= - ~SNDRV_CTL_ELEM_ACCESS_INACTIVE; - snd_ctl_notify(umidi->card, - SNDRV_CTL_EVENT_MASK_INFO, &ctl->id); + ctl_id = umidi->roland_load_ctl->id; + activate_ctl = true; + active = true; } } } mutex_unlock(&umidi->mutex); + if (activate_ctl) + snd_ctl_activate_id(umidi->card, &ctl_id, active); up_read(&umidi->disc_rwsem); return 0; } -- 2.53.0