Commit c54dac51 authored by Takashi Iwai's avatar Takashi Iwai Committed by Li Nan
Browse files

ALSA: us122l: Use snd_card_free_when_closed() at disconnection 

stable inclusion
from stable-v4.19.325
commit 020cbc4d7414f0962004213e2b7bc5cc607e9ec7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAG2
CVE: CVE-2024-56532

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=020cbc4d7414f0962004213e2b7bc5cc607e9ec7



--------------------------------

[ Upstream commit b7df09bb348016943f56b09dcaafe221e3f73947 ]

The USB disconnect callback is supposed to be short and not too-long
waiting.  OTOH, the current code uses snd_card_free() at
disconnection, but this waits for the close of all used fds, hence it
can take long.  It eventually blocks the upper layer USB ioctls, which
may trigger a soft lockup.

An easy workaround is to replace snd_card_free() with
snd_card_free_when_closed().  This variant returns immediately while
the release of resources is done asynchronously by the card device
release at the last close.

The loop of us122l->mmap_count check is dropped as well.  The check is
useless for the asynchronous operation with *_when_closed().

Fixes: 030a07e4 ("ALSA: Add USB US122L driver")
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20241113111042.15058-3-tiwai@suse.de


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parent 0945d3ef

sound/usb/usx2y/us122l.c

+1 −4
Original line number Diff line number Diff line
@@ -649,10 +649,7 @@ static void snd_us122l_disconnect(struct usb_interface *intf) 
	usb_put_intf(usb_ifnum_to_if(us122l->dev, 1));

	usb_put_dev(us122l->dev);



	while (atomic_read(&us122l->mmap_count))

		msleep(500);



	snd_card_free(card);

	snd_card_free_when_closed(card);

}



static int snd_us122l_suspend(struct usb_interface *intf, pm_message_t message)