From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590583; b=wDH7YvGJHh/ZWVPvQkBF923RkLp+WIXWW96VXuWNObeYtjrbsemTTPXY3XAnt61j2FJ0 b9wuQFcNxYx7saGi1HV9+Fiqy33AvzJdKVhAgHW13QpubTyk8ZBnTKmpt8CY1l5MxX5Vd VvZ1XMGYLVGfcbASVwrPAPOcgBXa02pScET/FULfsygY5wHc0c808ExEGuJCh0HNolVdL VadzfH68PF0gNxSOK0pyCaDuJ+VycmXSKBGeSWLibaopgH9RnH1pVPraBr5JiQ56o2emK ENdIa7JQg5vUtKI4vpfiFzzFV/xhr1i+3/5UFVsHJxIOsb1JU/BiOCjZiNEFo472ipg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590583; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=JbeqD5kYuGMkXWfBtIsLcsQZ1hBppU3EwAErHhSsZnE=; b=qhvZL+EZNg/lMyZ/cuPE3QzD4RYNAtAOetv8igP324GM1hBEK8OkqpNdmDQU0zdJMW1P 03aZLCS7LfLwlLY7I6QyLqD+yXumsmu6Yi4tXgfFiyLK35qfprgGFz94emJPjSlX7nEby ZUxMPAl8RK2EmHaaLM7+RvLuDw1DjGPXSIUI8oIG0WESQnGUxyXSMdNnFK69p8bUKJqmE oQQLjhrr+YZplg1laHKD5xWESp4LUIg3XzommwU5Vd7BfJeO7j0sBSXG36/PrhsrNnz8t Kgr7ombOv7uCKYpY8PlSHc6eP0rn5begAZ+JRoZylS1QoxIFC64y56v4nBN433dJAVg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=M79CGFJZ; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A73A606C081; Fri, 13 Nov 2026 17:23:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=M79CGFJZ Received: by smtp.kernel.org (Postfix) with ESMTPSA id DA2201F000C6; Fri, 13 Nov 2026 17:23:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590583; bh=JbeqD5kYuGMkXWfBtIsLcsQZ1hBppU3EwAErHhSsZnE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=M79CGFJZLWhGcN+mTqWeXVQAMTpi5+zMePG8eXAEILItiBxYJ1kiMQ+LAlt9jF54t nMgCfkd6MoSFeetgDLWVN/5bkRyk1mBCVRdEmA/Dok55SinoaYoeHHjlBQwNHAkVu5 TeZ5Dwgv6bt+q2zomBlWP0sXUDUHXUHQ1aHA9980= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Runyu Xiao , Takashi Iwai , Sasha Levin Subject: [PATCH 6.18 508/686] ALSA: usb-audio: Protect Roland control activation Date: Fri, 13 Nov 2026 10:50:41 -0500 Message-ID: <20261113153838.106398236@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153820.902362109@linuxfoundation.org> References: <20261113153820.902362109@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Runyu Xiao [ Upstream commit 19b42c1fff7f220a6346c614d79ce1bda6d95b40 ] The USB MIDI driver changes the Roland MIDI Input Mode control's access flags directly from the rawmidi open and close paths. These changes are not protected by the ALSA control core and the corresponding notifications can race with control access. Use snd_ctl_activate_id() so that the control core updates the access flags and sends the notification under its lock. Release the USB MIDI mutex before calling it because the control write path holds controls_rwsem while roland_load_put() takes the USB MIDI mutex. Keep the state transition and alternate-setting change under the USB MIDI mutex; rawmidi's open mutex serializes the enclosing open and close paths. Fixes: 96f61d9ade82 ("sound: usb-audio: allow switching altsetting on Roland USB MIDI devices") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Runyu Xiao Link: https://patch.msgid.link/20260929141726.2166899-1-runyu.xiao@seu.edu.cn Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin --- sound/usb/midi.c | 53 ++++++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 26 deletions(-) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index 30d0684920319..c404412ae53b9 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1146,41 +1146,42 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir, int open) { struct snd_usb_midi *umidi = substream->rmidi->private_data; - struct snd_kcontrol *ctl; + struct snd_ctl_elem_id ctl_id; + bool activate_ctl = false; + bool active; guard(rwsem_read)(&umidi->disc_rwsem); if (umidi->disconnected) return open ? -ENODEV : 0; - guard(mutex)(&umidi->mutex); - if (open) { - if (!umidi->opened[0] && !umidi->opened[1]) { - if (umidi->roland_load_ctl) { - ctl = umidi->roland_load_ctl; - ctl->vd[0].access |= - SNDRV_CTL_ELEM_ACCESS_INACTIVE; - snd_ctl_notify(umidi->card, - SNDRV_CTL_EVENT_MASK_INFO, &ctl->id); - update_roland_altsetting(umidi); + scoped_guard(mutex, &umidi->mutex) { + if (open) { + if (!umidi->opened[0] && !umidi->opened[1]) { + if (umidi->roland_load_ctl) { + ctl_id = umidi->roland_load_ctl->id; + activate_ctl = true; + active = false; + update_roland_altsetting(umidi); + } } - } - umidi->opened[dir]++; - if (umidi->opened[1]) - snd_usbmidi_input_start(&umidi->list); - } else { - umidi->opened[dir]--; - if (!umidi->opened[1] && !umidi->keep_input_running) - snd_usbmidi_input_stop(&umidi->list); - if (!umidi->opened[0] && !umidi->opened[1]) { - if (umidi->roland_load_ctl) { - ctl = umidi->roland_load_ctl; - ctl->vd[0].access &= - ~SNDRV_CTL_ELEM_ACCESS_INACTIVE; - snd_ctl_notify(umidi->card, - SNDRV_CTL_EVENT_MASK_INFO, &ctl->id); + umidi->opened[dir]++; + if (umidi->opened[1]) + snd_usbmidi_input_start(&umidi->list); + } else { + umidi->opened[dir]--; + if (!umidi->opened[1] && !umidi->keep_input_running) + snd_usbmidi_input_stop(&umidi->list); + if (!umidi->opened[0] && !umidi->opened[1]) { + if (umidi->roland_load_ctl) { + ctl_id = umidi->roland_load_ctl->id; + activate_ctl = true; + active = true; + } } } } + if (activate_ctl) + snd_ctl_activate_id(umidi->card, &ctl_id, active); return 0; } -- 2.53.0