ALSA: pcm: Fix unlocked state reads in read/write file ops

The PCM read/write and readv/writev file operations reject streams in
OPEN or DISCONNECTED state before accessing the configured runtime
parameters. However, each operation reads runtime->state without the
PCM stream lock.

PCM state updates are serialized by the stream lock and may occur
concurrently from IRQ context. Use a local predicate based on
snd_pcm_get_state() to take a locked state snapshot for these VFS entry
checks.

This also consolidates the duplicated OPEN and DISCONNECTED tests. The
conditions and returned errors remain unchanged.

Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260610-alsa-pcm-read-write-state-helper-v1-1-93b7b992db09@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index db4f5cb39088e7462a083322d8ddb76db873e5b3..7dc0060617f1e28d64957ab5c8360abee17eb7c3 100644 (file)
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -645,6 +645,14 @@ snd_pcm_state_t snd_pcm_get_state(struct snd_pcm_substream *substream)
 }
 EXPORT_SYMBOL_GPL(snd_pcm_get_state);
 
+static bool snd_pcm_state_open_or_disconnected(struct snd_pcm_substream *substream)
+{
+       snd_pcm_state_t state = snd_pcm_get_state(substream);
+
+       return state == SNDRV_PCM_STATE_OPEN ||
+              state == SNDRV_PCM_STATE_DISCONNECTED;
+}
+
 static inline void snd_pcm_timer_notify(struct snd_pcm_substream *substream,
                                        int event)
 {
@@ -3569,8 +3577,7 @@ static ssize_t snd_pcm_read(struct file *file, char __user *buf, size_t count,
        if (PCM_RUNTIME_CHECK(substream))
                return -ENXIO;
        runtime = substream->runtime;
-       if (runtime->state == SNDRV_PCM_STATE_OPEN ||
-           runtime->state == SNDRV_PCM_STATE_DISCONNECTED)
+       if (snd_pcm_state_open_or_disconnected(substream))
                return -EBADFD;
        if (!frame_aligned(runtime, count))
                return -EINVAL;
@@ -3594,8 +3601,7 @@ static ssize_t snd_pcm_write(struct file *file, const char __user *buf,
        if (PCM_RUNTIME_CHECK(substream))
                return -ENXIO;
        runtime = substream->runtime;
-       if (runtime->state == SNDRV_PCM_STATE_OPEN ||
-           runtime->state == SNDRV_PCM_STATE_DISCONNECTED)
+       if (snd_pcm_state_open_or_disconnected(substream))
                return -EBADFD;
        if (!frame_aligned(runtime, count))
                return -EINVAL;
@@ -3621,8 +3627,7 @@ static ssize_t snd_pcm_readv(struct kiocb *iocb, struct iov_iter *to)
        if (PCM_RUNTIME_CHECK(substream))
                return -ENXIO;
        runtime = substream->runtime;
-       if (runtime->state == SNDRV_PCM_STATE_OPEN ||
-           runtime->state == SNDRV_PCM_STATE_DISCONNECTED)
+       if (snd_pcm_state_open_or_disconnected(substream))
                return -EBADFD;
        if (!user_backed_iter(to))
                return -EINVAL;
@@ -3661,8 +3666,7 @@ static ssize_t snd_pcm_writev(struct kiocb *iocb, struct iov_iter *from)
        if (PCM_RUNTIME_CHECK(substream))
                return -ENXIO;
        runtime = substream->runtime;
-       if (runtime->state == SNDRV_PCM_STATE_OPEN ||
-           runtime->state == SNDRV_PCM_STATE_DISCONNECTED)
+       if (snd_pcm_state_open_or_disconnected(substream))
                return -EBADFD;
        if (!user_backed_iter(from))
                return -EINVAL;