git: 9847c2497d2b - stable/14 - sound: Wrap dsp_clone() and mixer_clone() with bus_topo_lock()

[Christos Margiolis]

The branch stable/14 has been updated by christos:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=9847c2497d2b5b5b1e956c6f565bf994358f545b

commit 9847c2497d2b5b5b1e956c6f565bf994358f545b
Author:     Christos Margiolis <chris...@freebsd.org>
AuthorDate: 2024-04-28 19:40:29 +0000
Commit:     Christos Margiolis <chris...@freebsd.org>
CommitDate: 2024-04-29 10:43:30 +0000

    sound: Wrap dsp_clone() and mixer_clone() with bus_topo_lock()
    
    Make sure that the softc isn't freed in between the checks.
    
    Sponsored by:   The FreeBSD Foundation
    MFC after;      1 day
    Reviewed by:    markj
    Differential Revision:  https://reviews.freebsd.org/D44991
    
    (cherry picked from commit b18b990d8e7b15d25243d85ea22374dfdde8a18b)
---
 sys/dev/sound/pcm/dsp.c   | 2 ++
 sys/dev/sound/pcm/mixer.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/sys/dev/sound/pcm/dsp.c b/sys/dev/sound/pcm/dsp.c
index 20625641a601..aa6c21f36601 100644
--- a/sys/dev/sound/pcm/dsp.c
+++ b/sys/dev/sound/pcm/dsp.c
@@ -2085,6 +2085,7 @@ dsp_clone(void *arg, struct ucred *cred, char *name, int 
namelen,
        }
        return;
 found:
+       bus_topo_lock();
        d = devclass_get_softc(pcm_devclass, snd_unit);
        /*
         * If we only have a single soundcard attached and we detach it right
@@ -2096,6 +2097,7 @@ found:
                *dev = d->dsp_dev;
                dev_ref(*dev);
        }
+       bus_topo_unlock();
 }
 
 static void
diff --git a/sys/dev/sound/pcm/mixer.c b/sys/dev/sound/pcm/mixer.c
index b84dfeba7043..0645089ac503 100644
--- a/sys/dev/sound/pcm/mixer.c
+++ b/sys/dev/sound/pcm/mixer.c
@@ -1375,12 +1375,14 @@ mixer_clone(void *arg,
        if (*dev != NULL)
                return;
        if (strcmp(name, "mixer") == 0) {
+               bus_topo_lock();
                d = devclass_get_softc(pcm_devclass, snd_unit);
                /* See related comment in dsp_clone(). */
                if (d != NULL && PCM_REGISTERED(d) && d->mixer_dev != NULL) {
                        *dev = d->mixer_dev;
                        dev_ref(*dev);
                }
+               bus_topo_unlock();
        }
 }