[alsa-devel] unload Audio drivers while playback stream is active case kernel crash

[Lars-Peter Clausen]

On 01/14/2015 08:43 AM, Takashi Iwai wrote:
> At Tue, 13 Jan 2015 21:54:12 +0000,
> Mark Brown wrote:
>>
>> On Tue, Jan 13, 2015 at 06:24:44PM +0100, Takashi Iwai wrote:
>>> Wang, Jiada (ESD) wrote:
>>
>>>> I am using i.MX6Q sabreSD board, which have imx_wm892 machine driver, wm8962 codec and SSI CPU DAI,
>>
>>>> I got Kernel crash when unloading audio drivers (playback stream is active)
>>>> modprobe -r snd_soc_imx_wm8962
>>>> modprobe -r snd_soc_fsl_ssi
>>>> modprobe -r snd_soc_wm8962
>>
>>> The root problem is that you can unload the module while playing.
>>> The corresponding module refcounts should have been increased during
>>> used.
>>
>>> Do we miss [try_]module_get() somewhere in ASoC?
>>
>> That doesn't help, users can still forcibly unbind the driver at runtime
>> without loading the module - and there's always the potential for
>> actually hotpluggable hardware.  The teardown paths should be able to
>> cope somewhat gracefully.
>
> The module refcount has to be handled while being used for stopping
> module unload.  That's irrelevant from the dynamic unbinding support
> itself.  Of course, the module refcount doesn't save the world, but
> it's the right fix for this particular scenario.

Refcounting won't help in this case. The issue is caused by a delayed work 
item that gets launched when the PCM stream is stopped. So if you decrease 
the refcount when the stream is stopped you still have a window where it is 
possible to remove the module while the work is still being scheduled.

And while we do flush the scheduled work when we remove the ASoC card this 
is done before snd_card_free() is called. So when snd_card_free() is called 
it gets re-scheduled again. I think the correct fix is to add a 
snd_card_disconnect() at the very top of soc_cleanup_card_resources().

- Lars