ALSA: firewire-motu: Protect register DSP event queue positions

The register DSP event queue is updated under parser->lock, but
snd_motu_register_dsp_message_parser_count_event() reads pull_pos and
push_pos without the lock.
snd_motu_register_dsp_message_parser_copy_event() also reads both queue
positions before taking the lock.

Protect these accesses with parser->lock as well. This keeps the hwdep
poll/read path consistent with the producer side and with the cached
meter/parameter accessors.

Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260521-alsa-firewire-motu-event-locking-v1-1-708e1c2b5e56@gmail.com

diff --git a/sound/firewire/motu/motu-register-dsp-message-parser.c b/sound/firewire/motu/motu-register-dsp-message-parser.c
index a8053e3ef06528f3a355f1dc11ad16253b406fbd..4ec23e6880d91324378f42c3010f4a7179ac1fd7 100644 (file)
--- a/sound/firewire/motu/motu-register-dsp-message-parser.c
+++ b/sound/firewire/motu/motu-register-dsp-message-parser.c
@@ -386,6 +386,8 @@ unsigned int snd_motu_register_dsp_message_parser_count_event(struct snd_motu *m
 {
        struct msg_parser *parser = motu->message_parser;
 
+       guard(spinlock_irqsave)(&parser->lock);
+
        if (parser->pull_pos > parser->push_pos)
                return EVENT_QUEUE_SIZE - parser->pull_pos + parser->push_pos;
        else
@@ -395,13 +397,14 @@ unsigned int snd_motu_register_dsp_message_parser_count_event(struct snd_motu *m
 bool snd_motu_register_dsp_message_parser_copy_event(struct snd_motu *motu, u32 *event)
 {
        struct msg_parser *parser = motu->message_parser;
-       unsigned int pos = parser->pull_pos;
-
-       if (pos == parser->push_pos)
-               return false;
+       unsigned int pos;
 
        guard(spinlock_irqsave)(&parser->lock);
 
+       if (parser->pull_pos == parser->push_pos)
+               return false;
+
+       pos = parser->pull_pos;
        *event = parser->event_queue[pos];
 
        ++pos;