We have tested this patch and confirm it eliminates the race we initially reported.

Best,

Gabe

On Tue, Aug 23, 2022 at 3:27 AM Takashi Iwai tiwai@suse.de wrote:

It's been reported that there is a possible data-race accessing to the global card_requested[] array at ALSA sequencer core, which is used for determining whether to call request_module() for the card or not. This data race itself is almost harmless, as it might end up with one extra request_module() call for the already loaded module at most. But it's still better to fix.

This patch addresses the possible data race of card_requested[] and client_requested[] arrays by replacing them with bitmask. It's an atomic operation and can work without locks.

Reported-by: Abhishek Shah abhishek.shah@columbia.edu Cc: stable@vger.kernel.org Link: https://urldefense.proofpoint.com/v2/url?u=https-3A__lore.kernel.org_r_CAEHB...

Signed-off-by: Takashi Iwai tiwai@suse.de

sound/core/seq/seq_clientmgr.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 2e9d695d336c..052a690b5e11 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -121,13 +121,13 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid) spin_unlock_irqrestore(&clients_lock, flags); #ifdef CONFIG_MODULES if (!in_interrupt()) {

•           static char client_requested[SNDRV_SEQ_GLOBAL_CLIENTS];
  

•           static char card_requested[SNDRV_CARDS];
  

•           static DECLARE_BITMAP(client_requested,
  

SNDRV_SEQ_GLOBAL_CLIENTS);

•           static DECLARE_BITMAP(card_requested, SNDRV_CARDS);
  

•           if (clientid < SNDRV_SEQ_GLOBAL_CLIENTS) {
                    int idx;
  
  

•                   if (!client_requested[clientid]) {
  

•                           client_requested[clientid] = 1;
  

•                   if (!test_and_set_bit(clientid, client_requested))
  

{ for (idx = 0; idx < 15; idx++) { if (seq_client_load[idx] < 0) break; @@ -142,10 +142,8 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid) int card = (clientid - SNDRV_SEQ_GLOBAL_CLIENTS) / SNDRV_SEQ_CLIENTS_PER_CARD; if (card < snd_ecards_limit) {

•                           if (! card_requested[card]) {
  

•                                   card_requested[card] = 1;
  

•                           if (!test_and_set_bit(card_requested,
  

card)) snd_request_card(card);

•                           }
                            snd_seq_device_load_drivers();
                    }
            }
  

-- 2.35.3

Apologies, I just realized the previous patch raised incompatible integer conversion warnings on that line during compilation. In the future I'll keep a closer eye out for relevant warnings when testing.

This patch still eliminates the race we initially reported.

Best,

Gabe

On Wed, Aug 24, 2022 at 2:03 AM Takashi Iwai tiwai@suse.de wrote:

On Tue, 23 Aug 2022 09:27:17 +0200, Takashi Iwai wrote:

...

It's been reported that there is a possible data-race accessing to the global card_requested[] array at ALSA sequencer core, which is used for determining whether to call request_module() for the card or not. This data race itself is almost harmless, as it might end up with one extra request_module() call for the already loaded module at most. But it's still better to fix.

This patch addresses the possible data race of card_requested[] and client_requested[] arrays by replacing them with bitmask. It's an atomic operation and can work without locks.

Reported-by: Abhishek Shah abhishek.shah@columbia.edu Cc: stable@vger.kernel.org Link: https://urldefense.proofpoint.com/v2/url?u=https-3A__lore.kernel.org_r_CAEHB... Signed-off-by: Takashi Iwai tiwai@suse.de

Gah, there was an obvious type in the patch. The correct version is below, and I merged it now.

thanks,

Takashi

-- 8< -- From: Takashi Iwai tiwai@suse.de Subject: [PATCH v2] ALSA: seq: Fix data-race at module auto-loading

It's been reported that there is a possible data-race accessing to the global card_requested[] array at ALSA sequencer core, which is used for determining whether to call request_module() for the card or not. This data race itself is almost harmless, as it might end up with one extra request_module() call for the already loaded module at most. But it's still better to fix.

This patch addresses the possible data race of card_requested[] and client_requested[] arrays by replacing them with bitmask. It's an atomic operation and can work without locks.

Reported-by: Abhishek Shah abhishek.shah@columbia.edu Cc: stable@vger.kernel.org Link: https://urldefense.proofpoint.com/v2/url?u=https-3A__lore.kernel.org_r_CAEHB... Link: https://urldefense.proofpoint.com/v2/url?u=https-3A__lore.kernel.org_r_20220... Signed-off-by: Takashi Iwai tiwai@suse.de

---

v1->v2: fix compile error

sound/core/seq/seq_clientmgr.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 2e9d695d336c..2d707afa1ef1 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -121,13 +121,13 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid) spin_unlock_irqrestore(&clients_lock, flags); #ifdef CONFIG_MODULES if (!in_interrupt()) {

•           static char client_requested[SNDRV_SEQ_GLOBAL_CLIENTS];
  

•           static char card_requested[SNDRV_CARDS];
  

•           static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS);
  

•           static DECLARE_BITMAP(card_requested, SNDRV_CARDS);
  

•           if (clientid < SNDRV_SEQ_GLOBAL_CLIENTS) {
                    int idx;
  
  

•                   if (!client_requested[clientid]) {
  

•                           client_requested[clientid] = 1;
  

•                   if (!test_and_set_bit(clientid, client_requested)) {
                            for (idx = 0; idx < 15; idx++) {
                                    if (seq_client_load[idx] < 0)
                                            break;
  

@@ -142,10 +142,8 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid) int card = (clientid - SNDRV_SEQ_GLOBAL_CLIENTS) / SNDRV_SEQ_CLIENTS_PER_CARD; if (card < snd_ecards_limit) {

•                           if (! card_requested[card]) {
  

•                                   card_requested[card] = 1;
  

•                           if (!test_and_set_bit(card, card_requested))
                                    snd_request_card(card);
  

•                           }
                            snd_seq_device_load_drivers();
                    }
            }
  

-- 2.35.3