From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Takashi Iwai <tiwai@suse.de>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.6.y 4/5] ALSA: synth: Use guard() for spin locks
Date: Tue, 10 Nov 2026 18:12:34 -0500 [thread overview]
Message-ID: <20261110231146.73238-4-sashal@kernel.org> (raw)
In-Reply-To: <20261110231146.73238-1-sashal@kernel.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 59ede7178d402b3bfa0266cbd9ad348d5612c295 ]
Clean up the code using guard() for spin locks.
Merely code refactoring, and no behavior change.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250829151335.7342-5-tiwai@suse.de
Stable-dep-of: 34e3e04b8a17 ("ALSA: emux: Fix UAF of soundfont zones at note-on")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/synth/emux/emux_effect.c | 29 ++++++++--------
sound/synth/emux/emux_synth.c | 54 +++++++----------------------
sound/synth/emux/soundfont.c | 63 ++++++++++++----------------------
3 files changed, 49 insertions(+), 97 deletions(-)
diff --git a/sound/synth/emux/emux_effect.c b/sound/synth/emux/emux_effect.c
index 3c7314f5fb19c..bfe383fa90ba1 100644
--- a/sound/synth/emux/emux_effect.c
+++ b/sound/synth/emux/emux_effect.c
@@ -168,7 +168,6 @@ snd_emux_send_effect(struct snd_emux_port *port, struct snd_midi_channel *chan,
unsigned char *srcp, *origp;
struct snd_emux *emu;
struct snd_emux_effect_table *fx;
- unsigned long flags;
emu = port->emu;
fx = chan->private;
@@ -195,22 +194,22 @@ snd_emux_send_effect(struct snd_emux_port *port, struct snd_midi_channel *chan,
offset++;
#endif
/* modify the register values */
- spin_lock_irqsave(&emu->voice_lock, flags);
- for (i = 0; i < emu->max_voices; i++) {
- struct snd_emux_voice *vp = &emu->voices[i];
- if (!STATE_IS_PLAYING(vp->state) || vp->chan != chan)
- continue;
- srcp = (unsigned char*)&vp->reg.parm + offset;
- origp = (unsigned char*)&vp->zone->v.parm + offset;
- if (parm_defs[i].type & PARM_IS_BYTE) {
- *srcp = *origp;
- effect_set_byte(srcp, chan, type);
- } else {
- *(unsigned short*)srcp = *(unsigned short*)origp;
- effect_set_word((unsigned short*)srcp, chan, type);
+ scoped_guard(spinlock_irqsave, &emu->voice_lock) {
+ for (i = 0; i < emu->max_voices; i++) {
+ struct snd_emux_voice *vp = &emu->voices[i];
+ if (!STATE_IS_PLAYING(vp->state) || vp->chan != chan)
+ continue;
+ srcp = (unsigned char *)&vp->reg.parm + offset;
+ origp = (unsigned char *)&vp->zone->v.parm + offset;
+ if (parm_defs[i].type & PARM_IS_BYTE) {
+ *srcp = *origp;
+ effect_set_byte(srcp, chan, type);
+ } else {
+ *(unsigned short *)srcp = *(unsigned short *)origp;
+ effect_set_word((unsigned short *)srcp, chan, type);
+ }
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
/* activate them */
snd_emux_update_channel(port, chan, parm_defs[type].update);
diff --git a/sound/synth/emux/emux_synth.c b/sound/synth/emux/emux_synth.c
index 02e2c69d7f18e..b3c8296840a56 100644
--- a/sound/synth/emux/emux_synth.c
+++ b/sound/synth/emux/emux_synth.c
@@ -49,7 +49,6 @@ snd_emux_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
int i, key, nvoices;
struct snd_emux_voice *vp;
struct snd_sf_zone *table[SNDRV_EMUX_MAX_MULTI_VOICES];
- unsigned long flags;
struct snd_emux_port *port;
port = p;
@@ -77,7 +76,7 @@ snd_emux_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
terminate_note1(emu, key, chan, 0);
#endif
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < nvoices; i++) {
/* set up each voice parameter */
@@ -124,7 +123,6 @@ snd_emux_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
vp->ontime = jiffies; /* remember the trigger timing */
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
#ifdef SNDRV_EMUX_USE_RAW_EFFECT
if (port->port_mode == SNDRV_EMUX_PORT_MODE_OSS_SYNTH) {
@@ -147,7 +145,6 @@ snd_emux_note_off(void *p, int note, int vel, struct snd_midi_channel *chan)
int ch;
struct snd_emux *emu;
struct snd_emux_voice *vp;
- unsigned long flags;
struct snd_emux_port *port;
port = p;
@@ -158,7 +155,7 @@ snd_emux_note_off(void *p, int note, int vel, struct snd_midi_channel *chan)
if (snd_BUG_ON(!emu || !emu->ops.release))
return;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (ch = 0; ch < emu->max_voices; ch++) {
vp = &emu->voices[ch];
if (STATE_IS_PLAYING(vp->state) &&
@@ -180,7 +177,6 @@ snd_emux_note_off(void *p, int note, int vel, struct snd_midi_channel *chan)
emu->ops.release(vp);
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
/*
@@ -192,10 +188,9 @@ void snd_emux_timer_callback(struct timer_list *t)
{
struct snd_emux *emu = from_timer(emu, t, tlist);
struct snd_emux_voice *vp;
- unsigned long flags;
int ch, do_again = 0;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (ch = 0; ch < emu->max_voices; ch++) {
vp = &emu->voices[ch];
if (vp->state == SNDRV_EMUX_ST_PENDING) {
@@ -212,7 +207,6 @@ void snd_emux_timer_callback(struct timer_list *t)
emu->timer_active = 1;
} else
emu->timer_active = 0;
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
/*
@@ -224,7 +218,6 @@ snd_emux_key_press(void *p, int note, int vel, struct snd_midi_channel *chan)
int ch;
struct snd_emux *emu;
struct snd_emux_voice *vp;
- unsigned long flags;
struct snd_emux_port *port;
port = p;
@@ -235,7 +228,7 @@ snd_emux_key_press(void *p, int note, int vel, struct snd_midi_channel *chan)
if (snd_BUG_ON(!emu || !emu->ops.update))
return;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (ch = 0; ch < emu->max_voices; ch++) {
vp = &emu->voices[ch];
if (vp->state == SNDRV_EMUX_ST_ON &&
@@ -244,7 +237,6 @@ snd_emux_key_press(void *p, int note, int vel, struct snd_midi_channel *chan)
update_voice(emu, vp, SNDRV_EMUX_UPDATE_VOLUME);
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
@@ -257,7 +249,6 @@ snd_emux_update_channel(struct snd_emux_port *port, struct snd_midi_channel *cha
struct snd_emux *emu;
struct snd_emux_voice *vp;
int i;
- unsigned long flags;
if (! update)
return;
@@ -266,13 +257,12 @@ snd_emux_update_channel(struct snd_emux_port *port, struct snd_midi_channel *cha
if (snd_BUG_ON(!emu || !emu->ops.update))
return;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (vp->chan == chan)
update_voice(emu, vp, update);
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
/*
@@ -284,7 +274,6 @@ snd_emux_update_port(struct snd_emux_port *port, int update)
struct snd_emux *emu;
struct snd_emux_voice *vp;
int i;
- unsigned long flags;
if (! update)
return;
@@ -293,13 +282,12 @@ snd_emux_update_port(struct snd_emux_port *port, int update)
if (snd_BUG_ON(!emu || !emu->ops.update))
return;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (vp->port == port)
update_voice(emu, vp, update);
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
@@ -365,16 +353,14 @@ terminate_note1(struct snd_emux *emu, int note, struct snd_midi_channel *chan, i
{
int i;
struct snd_emux_voice *vp;
- unsigned long flags;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (STATE_IS_PLAYING(vp->state) && vp->chan == chan &&
vp->key == note)
terminate_voice(emu, vp, free);
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
@@ -407,9 +393,8 @@ snd_emux_terminate_all(struct snd_emux *emu)
{
int i;
struct snd_emux_voice *vp;
- unsigned long flags;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (STATE_IS_PLAYING(vp->state))
@@ -424,7 +409,6 @@ snd_emux_terminate_all(struct snd_emux *emu)
}
/* initialize allocation time */
emu->use_time = 0;
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
EXPORT_SYMBOL(snd_emux_terminate_all);
@@ -438,7 +422,6 @@ snd_emux_sounds_off_all(struct snd_emux_port *port)
int i;
struct snd_emux *emu;
struct snd_emux_voice *vp;
- unsigned long flags;
if (snd_BUG_ON(!port))
return;
@@ -446,7 +429,7 @@ snd_emux_sounds_off_all(struct snd_emux_port *port)
if (snd_BUG_ON(!emu || !emu->ops.terminate))
return;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (STATE_IS_PLAYING(vp->state) &&
@@ -459,7 +442,6 @@ snd_emux_sounds_off_all(struct snd_emux_port *port)
emu->ops.reset(emu, i);
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
@@ -472,9 +454,8 @@ exclusive_note_off(struct snd_emux *emu, struct snd_emux_port *port, int exclass
{
struct snd_emux_voice *vp;
int i;
- unsigned long flags;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
if (STATE_IS_PLAYING(vp->state) && vp->port == port &&
@@ -482,7 +463,6 @@ exclusive_note_off(struct snd_emux *emu, struct snd_emux_port *port, int exclass
terminate_voice(emu, vp, 0);
}
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
/*
@@ -916,9 +896,8 @@ snd_emux_init_voices(struct snd_emux *emu)
{
struct snd_emux_voice *vp;
int i;
- unsigned long flags;
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
for (i = 0; i < emu->max_voices; i++) {
vp = &emu->voices[i];
vp->ch = -1; /* not used */
@@ -929,23 +908,19 @@ snd_emux_init_voices(struct snd_emux *emu)
vp->emu = emu;
vp->hw = emu->hw;
}
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
/*
*/
void snd_emux_lock_voice(struct snd_emux *emu, int voice)
{
- unsigned long flags;
-
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
if (emu->voices[voice].state == SNDRV_EMUX_ST_OFF)
emu->voices[voice].state = SNDRV_EMUX_ST_LOCKED;
else
dev_warn(emu->card->dev,
"invalid voice for lock %d (state = %x)\n",
voice, emu->voices[voice].state);
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
EXPORT_SYMBOL(snd_emux_lock_voice);
@@ -954,16 +929,13 @@ EXPORT_SYMBOL(snd_emux_lock_voice);
*/
void snd_emux_unlock_voice(struct snd_emux *emu, int voice)
{
- unsigned long flags;
-
- spin_lock_irqsave(&emu->voice_lock, flags);
+ guard(spinlock_irqsave)(&emu->voice_lock);
if (emu->voices[voice].state == SNDRV_EMUX_ST_LOCKED)
emu->voices[voice].state = SNDRV_EMUX_ST_OFF;
else
dev_warn(emu->card->dev,
"invalid voice for unlock %d (state = %x)\n",
voice, emu->voices[voice].state);
- spin_unlock_irqrestore(&emu->voice_lock, flags);
}
EXPORT_SYMBOL(snd_emux_unlock_voice);
diff --git a/sound/synth/emux/soundfont.c b/sound/synth/emux/soundfont.c
index 03f70cceb4a86..c124d6c27a945 100644
--- a/sound/synth/emux/soundfont.c
+++ b/sound/synth/emux/soundfont.c
@@ -66,11 +66,9 @@ static void snd_sf_clear(struct snd_sf_list *sflist);
static void
lock_preset(struct snd_sf_list *sflist)
{
- unsigned long flags;
mutex_lock(&sflist->presets_mutex);
- spin_lock_irqsave(&sflist->lock, flags);
+ guard(spinlock_irqsave)(&sflist->lock);
sflist->presets_locked = 1;
- spin_unlock_irqrestore(&sflist->lock, flags);
}
@@ -80,10 +78,8 @@ lock_preset(struct snd_sf_list *sflist)
static void
unlock_preset(struct snd_sf_list *sflist)
{
- unsigned long flags;
- spin_lock_irqsave(&sflist->lock, flags);
+ guard(spinlock_irqsave)(&sflist->lock);
sflist->presets_locked = 0;
- spin_unlock_irqrestore(&sflist->lock, flags);
mutex_unlock(&sflist->presets_mutex);
}
@@ -94,14 +90,11 @@ unlock_preset(struct snd_sf_list *sflist)
int
snd_soundfont_close_check(struct snd_sf_list *sflist, int client)
{
- unsigned long flags;
- spin_lock_irqsave(&sflist->lock, flags);
- if (sflist->open_client == client) {
- spin_unlock_irqrestore(&sflist->lock, flags);
- return close_patch(sflist);
+ scoped_guard(spinlock_irqsave, &sflist->lock) {
+ if (sflist->open_client != client)
+ return 0;
}
- spin_unlock_irqrestore(&sflist->lock, flags);
- return 0;
+ return close_patch(sflist);
}
@@ -119,7 +112,6 @@ snd_soundfont_load(struct snd_card *card,
long count, int client)
{
struct soundfont_patch_info patch;
- unsigned long flags;
int rc;
if (count < (long)sizeof(patch)) {
@@ -155,12 +147,10 @@ snd_soundfont_load(struct snd_card *card,
}
/* check if other client already opened patch */
- spin_lock_irqsave(&sflist->lock, flags);
- if (sflist->open_client != client) {
- spin_unlock_irqrestore(&sflist->lock, flags);
- return -EBUSY;
+ scoped_guard(spinlock_irqsave, &sflist->lock) {
+ if (sflist->open_client != client)
+ return -EBUSY;
}
- spin_unlock_irqrestore(&sflist->lock, flags);
lock_preset(sflist);
rc = -EINVAL;
@@ -223,14 +213,11 @@ open_patch(struct snd_sf_list *sflist, const char __user *data,
{
struct soundfont_open_parm parm;
struct snd_soundfont *sf;
- unsigned long flags;
- spin_lock_irqsave(&sflist->lock, flags);
- if (sflist->open_client >= 0 || sflist->currsf) {
- spin_unlock_irqrestore(&sflist->lock, flags);
- return -EBUSY;
+ scoped_guard(spinlock_irqsave, &sflist->lock) {
+ if (sflist->open_client >= 0 || sflist->currsf)
+ return -EBUSY;
}
- spin_unlock_irqrestore(&sflist->lock, flags);
if (copy_from_user(&parm, data, sizeof(parm)))
return -EFAULT;
@@ -244,10 +231,10 @@ open_patch(struct snd_sf_list *sflist, const char __user *data,
return -ENOMEM;
}
- spin_lock_irqsave(&sflist->lock, flags);
- sflist->open_client = client;
- sflist->currsf = sf;
- spin_unlock_irqrestore(&sflist->lock, flags);
+ scoped_guard(spinlock_irqsave, &sflist->lock) {
+ sflist->open_client = client;
+ sflist->currsf = sf;
+ }
return 0;
}
@@ -305,12 +292,10 @@ is_identical_font(struct snd_soundfont *sf, int type, unsigned char *name)
static int
close_patch(struct snd_sf_list *sflist)
{
- unsigned long flags;
-
- spin_lock_irqsave(&sflist->lock, flags);
- sflist->currsf = NULL;
- sflist->open_client = -1;
- spin_unlock_irqrestore(&sflist->lock, flags);
+ scoped_guard(spinlock_irqsave, &sflist->lock) {
+ sflist->currsf = NULL;
+ sflist->open_client = -1;
+ }
rebuild_presets(sflist);
@@ -1243,17 +1228,14 @@ snd_soundfont_search_zone(struct snd_sf_list *sflist, int *notep, int vel,
struct snd_sf_zone **table, int max_layers)
{
int nvoices;
- unsigned long flags;
/* this function is supposed to be called atomically,
* so we check the lock. if it's busy, just returns 0 to
* tell the caller the busy state
*/
- spin_lock_irqsave(&sflist->lock, flags);
- if (sflist->presets_locked) {
- spin_unlock_irqrestore(&sflist->lock, flags);
+ guard(spinlock_irqsave)(&sflist->lock);
+ if (sflist->presets_locked)
return 0;
- }
nvoices = search_zones(sflist, notep, vel, preset, bank,
table, max_layers, 0);
if (! nvoices) {
@@ -1262,7 +1244,6 @@ snd_soundfont_search_zone(struct snd_sf_list *sflist, int *notep, int vel,
def_preset, def_bank,
table, max_layers, 0);
}
- spin_unlock_irqrestore(&sflist->lock, flags);
return nvoices;
}
--
2.53.0
next prev parent reply other threads:[~2026-11-10 23:12 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-07 10:37 FAILED: patch "[PATCH] ALSA: emux: Fix UAF of soundfont zones at note-on" failed to apply to 6.6-stable tree Sasha Levin
2026-11-10 23:12 ` [PATCH 6.6.y 1/5] ALSA: emux: prune unused parameter from snd_soundfont_load_guspatch() Sasha Levin
2026-11-10 23:12 ` [PATCH 6.6.y 2/5] ALSA: emux: fix validation of snd_emux.num_ports Sasha Levin
2026-11-10 23:12 ` [PATCH 6.6.y 3/5] ALSA: emux: Use standard print API Sasha Levin
2026-11-10 23:12 ` Sasha Levin [this message]
2026-11-10 23:12 ` [PATCH 6.6.y 5/5] ALSA: emux: Fix UAF of soundfont zones at note-on Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261110231146.73238-4-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox