From 7bc02ab446d38d8d56c548abcb974dfd6fade147 Mon Sep 17 00:00:00 2001 From: =?utf8?q?C=C3=A1ssio=20Gabriel?= Date: Wed, 10 Jun 2026 08:31:30 -0300 Subject: [PATCH] ALSA: pcm: Fix unlocked state reads in read/write file ops MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit The PCM read/write and readv/writev file operations reject streams in OPEN or DISCONNECTED state before accessing the configured runtime parameters. However, each operation reads runtime->state without the PCM stream lock. PCM state updates are serialized by the stream lock and may occur concurrently from IRQ context. Use a local predicate based on snd_pcm_get_state() to take a locked state snapshot for these VFS entry checks. This also consolidates the duplicated OPEN and DISCONNECTED tests. The conditions and returned errors remain unchanged. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260610-alsa-pcm-read-write-state-helper-v1-1-93b7b992db09@gmail.com Signed-off-by: Takashi Iwai --- sound/core/pcm_native.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index db4f5cb39088..7dc0060617f1 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -645,6 +645,14 @@ snd_pcm_state_t snd_pcm_get_state(struct snd_pcm_substream *substream) } EXPORT_SYMBOL_GPL(snd_pcm_get_state); +static bool snd_pcm_state_open_or_disconnected(struct snd_pcm_substream *substream) +{ + snd_pcm_state_t state = snd_pcm_get_state(substream); + + return state == SNDRV_PCM_STATE_OPEN || + state == SNDRV_PCM_STATE_DISCONNECTED; +} + static inline void snd_pcm_timer_notify(struct snd_pcm_substream *substream, int event) { @@ -3569,8 +3577,7 @@ static ssize_t snd_pcm_read(struct file *file, char __user *buf, size_t count, if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime = substream->runtime; - if (runtime->state == SNDRV_PCM_STATE_OPEN || - runtime->state == SNDRV_PCM_STATE_DISCONNECTED) + if (snd_pcm_state_open_or_disconnected(substream)) return -EBADFD; if (!frame_aligned(runtime, count)) return -EINVAL; @@ -3594,8 +3601,7 @@ static ssize_t snd_pcm_write(struct file *file, const char __user *buf, if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime = substream->runtime; - if (runtime->state == SNDRV_PCM_STATE_OPEN || - runtime->state == SNDRV_PCM_STATE_DISCONNECTED) + if (snd_pcm_state_open_or_disconnected(substream)) return -EBADFD; if (!frame_aligned(runtime, count)) return -EINVAL; @@ -3621,8 +3627,7 @@ static ssize_t snd_pcm_readv(struct kiocb *iocb, struct iov_iter *to) if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime = substream->runtime; - if (runtime->state == SNDRV_PCM_STATE_OPEN || - runtime->state == SNDRV_PCM_STATE_DISCONNECTED) + if (snd_pcm_state_open_or_disconnected(substream)) return -EBADFD; if (!user_backed_iter(to)) return -EINVAL; @@ -3661,8 +3666,7 @@ static ssize_t snd_pcm_writev(struct kiocb *iocb, struct iov_iter *from) if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime = substream->runtime; - if (runtime->state == SNDRV_PCM_STATE_OPEN || - runtime->state == SNDRV_PCM_STATE_DISCONNECTED) + if (snd_pcm_state_open_or_disconnected(substream)) return -EBADFD; if (!user_backed_iter(from)) return -EINVAL; -- 2.47.3