[alsa-devel] ALSA: usb-audio: fix oops due to cleanup race when disconnecting

[Takashi Iwai]

At Tue, 22 Feb 2011 16:19:20 -0600,
pl bossart wrote:
> 
> >> Ah, I forgot to put my sign-off since I was waiting for any test
> >> result...  Has anyone tried it?
> >
> > Doesn't work for me. same oops as before. Either I made a mistake when
> > merging this patch manually (there were some rejects), or the problem
> > is still there.
> 
> Added some additional traces, the dereference takes place before the
> mutex is unlocked.
> 
> usb 3-1: USB disconnect, address 5
> ALSA card.c:556: locking USB shutdown mutex
> ALSA urb.c:492: frame 0 active: -84
> ALSA urb.c:197: cannot submit urb (err = -19)
> ALSA urb.c:492: frame 0 active: -84
> ALSA urb.c:197: cannot submit urb (err = -19)
> ALSA urb.c:492: frame 0 active: -84
> ALSA urb.c:197: cannot submit urb (err = -19)
> ALSA urb.c:492: frame 0 active: -84
> ALSA urb.c:197: cannot submit urb (err = -19)
> ALSA urb.c:186: NULL substream (subs->running 0)
> ALSA urb.c:186: NULL substream (subs->running 0)
> ALSA card.c:575: UNlocking USB shutdown mutex

Hmm.  Is snd_usb_release_substream_urbs() is called properly before
these errors?  Is force=1 set?

Also, in your log, it shows subs->running = 0.  So, there is no
NULL dereference.  But, it's still strange since all active URLs
must have been killed beforehand in deactivate_urbs() and the
succeeding call of wait_clear_urbs()...


Takashi