[alsa-devel] ALSA: usb-audio: fix oops due to cleanup race when disconnecting

[pl bossart]

>> When a USB audio device is disconnected, snd_usb_audio_disconnect()
>> kills all audio URBs.  At the same time, the application, after being
>> notified of the disconnection, might close the device, in which case
>> ALSA calls the .hw_free callback, which should free the URBs too.
>>
>> Commit de1b8b93a0ba prevented snd_usb_hw_free() from freeing the URBs to
>> avoid a hang that resulted from this race, but this introduced another
>> race because the URB callbacks could now be executed after
>> snd_usb_hw_free() has returned, and try to access already freed data.
>>
>> Fix the first race by introducing a mutex to serialize the disconnect
>> callback and all PCM callbacks that manage URBs (hw_free and hw_params).
>>
>> Reported-by: Pierre-Louis Bossart <pierre-louis.bossart at intel.com>
>> [CL: also serialize hw_params callback]
>> Signed-off-by: Clemens Ladisch <clemens at ladisch.de>
>
> Ah, I forgot to put my sign-off since I was waiting for any test
> result...  Has anyone tried it?

Doesn't work for me. same oops as before. Either I made a mistake when
merging this patch manually (there were some rejects), or the problem
is still there.
-Pierre