linux-kernel - [BUG] ALSA: usb-audio: drain may fail with multi-port close race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250217111647.3368132-1-jkeeping@inmusicbrands.com>
Date: Mon, 17 Feb 2025 11:16:46 +0000
From: John Keeping <jkeeping@...usicbrands.com>
To: Takashi Iwai <tiwai@...e.com>
Cc: John Keeping <jkeeping@...usicbrands.com>,
	Clemens Ladisch <clemens@...isch.de>,
	Jaroslav Kysela <perex@...ex.cz>,
	linux-sound@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [BUG] ALSA: usb-audio: drain may fail with multi-port close race

I'm seeing a bug where data sometimes fails to send on USB MIDI devices
with multiple ports which seems to be a result of a race around closing
ports introduced by commit 0125de38122f0 ("ALSA: usb-audio: Cancel
pending work at closing a MIDI substream").

The scenario is essentially this program:

	snd_rawmidi_t *port0, *port1;
	snd_rawmidi_open(NULL, &port0, "hw:0,0,0", 0);
	snd_rawmidi_open(NULL, &port1, "hw:0,0,1", 0);

	snd_rawmidi_write(port0, data, len);

	snd_rawmidi_close(port1);
	snd_rawmidi_close(port0);

What happens seems to be the following:

	write(port0)
	`- snd_usbmidi_output_trigger
	   `- queue_work()
        close(port1)
	`- snd_usbmidi_output_close
	   `- cancel_work_sync()	# Work has not yet started here
	close(port0)
	`- snd_rawmidi_drain_output
	   # Times out because nothing is processing outbound data!

The two ports interact like this because they are on the same endpoint,
so should the work only be cancelled when the last endpoint is closed?

Thanks,
John