From 7d357eae973a1e1933f81f55aa1b3b4e3064570f Mon Sep 17 00:00:00 2001 From: Peter Ujfalusi Date: Tue, 27 Oct 2026 10:38:38 +0200 Subject: [PATCH 1/3] ASoC: hdac_hda: Allocate the private data at codec driver bind The SOF HDA code allocates struct hdac_hda_priv and stores it as drvdata of the codec device before the codec driver is bound. The driver core clears drvdata on unbind, so after unbinding the codec driver via sysfs a subsequent bind dereferences a NULL pointer in hdac_hda_dev_probe(). All information in the private data can be derived from the codec device itself, so allocate and set it up in hdac_hda_dev_probe() as a device managed resource, which is released on unbind. Remove the allocation from SOF, keeping the check for iDisp codecs without display audio component. Fixes: 3fd63658caed ("ASoC: Intel: Drop hdac_ext usage for codec device creation") Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20261027083840.28813-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown --- sound/soc/codecs/hdac_hda.c | 13 ++++++++++++- sound/soc/sof/intel/hda-codec.c | 23 ++++------------------- 2 files changed, 16 insertions(+), 20 deletions(-) diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c index 7414be08d3d5..46617fc88277 100644 --- a/sound/soc/codecs/hdac_hda.c +++ b/sound/soc/codecs/hdac_hda.c @@ -619,10 +619,21 @@ static const struct snd_soc_component_driver hdac_hda_hdmi_codec = { static int hdac_hda_dev_probe(struct hdac_device *hdev) { - struct hdac_hda_priv *hda_pvt = dev_get_drvdata(&hdev->dev); + struct hdac_hda_priv *hda_pvt; struct hdac_ext_link *hlink; int ret; + hda_pvt = devm_kzalloc(&hdev->dev, sizeof(*hda_pvt), GFP_KERNEL); + if (!hda_pvt) + return -ENOMEM; + + hda_pvt->codec = dev_to_hda_codec(&hdev->dev); + hda_pvt->dev_index = hdev->addr; + /* Intel iDisp (HDMI/DP) codec */ + if (((hdev->vendor_id >> 16) & 0xFFFF) == 0x8086) + hda_pvt->need_display_power = true; + dev_set_drvdata(&hdev->dev, hda_pvt); + /* hold the ref while we probe */ hlink = snd_hdac_ext_bus_get_hlink_by_name(hdev->bus, dev_name(&hdev->dev)); if (!hlink) { diff --git a/sound/soc/sof/intel/hda-codec.c b/sound/soc/sof/intel/hda-codec.c index fd371850b0d6..32fcc1cd3f92 100644 --- a/sound/soc/sof/intel/hda-codec.c +++ b/sound/soc/sof/intel/hda-codec.c @@ -15,8 +15,6 @@ #include "hda.h" #if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA_AUDIO_CODEC) -#include "../../codecs/hdac_hda.h" - #define CODEC_PROBE_RETRIES 3 #define IDISP_VID_INTEL 0x80860000 @@ -148,7 +146,6 @@ static struct hda_codec *hda_codec_device_init(struct hdac_bus *bus, int addr, i /* probe individual codec */ static int hda_codec_probe(struct snd_sof_dev *sdev, int address) { - struct hdac_hda_priv *hda_priv; struct hda_bus *hbus = sof_to_hbus(sdev); struct hda_codec *codec; u32 hda_cmd = (address << 28) | (AC_NODE_ROOT << 20) | @@ -168,27 +165,15 @@ static int hda_codec_probe(struct snd_sof_dev *sdev, int address) dev_dbg(sdev->dev, "HDA codec #%d probed OK: response: %x\n", address, resp); - hda_priv = devm_kzalloc(sdev->dev, sizeof(*hda_priv), GFP_KERNEL); - if (!hda_priv) - return -ENOMEM; - codec = hda_codec_device_init(&hbus->core, address, HDA_DEV_LEGACY); ret = PTR_ERR_OR_ZERO(codec); if (ret < 0) return ret; - hda_priv->codec = codec; - hda_priv->dev_index = address; - dev_set_drvdata(&codec->core.dev, hda_priv); - - if ((resp & 0xFFFF0000) == IDISP_VID_INTEL) { - if (!hbus->core.audio_component) { - dev_dbg(sdev->dev, - "iDisp hw present but no driver\n"); - ret = -ENOENT; - goto out; - } - hda_priv->need_display_power = true; + if ((resp & 0xFFFF0000) == IDISP_VID_INTEL && !hbus->core.audio_component) { + dev_dbg(sdev->dev, "iDisp hw present but no driver\n"); + ret = -ENOENT; + goto out; } if (is_generic_config(hbus)) From 08a44bde821d4fe22c0b6e63da04b3c59ac243a8 Mon Sep 17 00:00:00 2001 From: Peter Ujfalusi Date: Tue, 27 Oct 2026 10:38:39 +0200 Subject: [PATCH 2/3] ASoC: hdac_hda: Restore the codec device type on unbind hdac_hda_codec_probe() changes the type of the codec device to HDA_DEV_ASOC to prevent snd_hda_codec_unregister() from unregistering the device when the card is freed. The type is never restored, and hda_bus_match() requires the device and driver types to be equal. After unbinding the codec driver via sysfs the HDA_DEV_LEGACY codec drivers no longer match the device and bind fails with -ENODEV. Restore HDA_DEV_LEGACY with a device managed action registered before the component, so it runs after the component and the card are gone. Fixes: b60ee2e281b6 ("ASoC: hdac_hda: overwrite hdev type to HDA_DEV_ASOC") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20261027083840.28813-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown --- sound/soc/codecs/hdac_hda.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c index 46617fc88277..cae5711e979c 100644 --- a/sound/soc/codecs/hdac_hda.c +++ b/sound/soc/codecs/hdac_hda.c @@ -617,6 +617,13 @@ static const struct snd_soc_component_driver hdac_hda_hdmi_codec = { .endianness = 1, }; +static void hdac_hda_restore_dev_type(void *data) +{ + struct hdac_device *hdev = data; + + hdev->type = HDA_DEV_LEGACY; +} + static int hdac_hda_dev_probe(struct hdac_device *hdev) { struct hdac_hda_priv *hda_pvt; @@ -634,6 +641,11 @@ static int hdac_hda_dev_probe(struct hdac_device *hdev) hda_pvt->need_display_power = true; dev_set_drvdata(&hdev->dev, hda_pvt); + /* Allow the legacy codec driver to match again after unbind */ + ret = devm_add_action(&hdev->dev, hdac_hda_restore_dev_type, hdev); + if (ret) + return ret; + /* hold the ref while we probe */ hlink = snd_hdac_ext_bus_get_hlink_by_name(hdev->bus, dev_name(&hdev->dev)); if (!hlink) { From f26c0d5f91d918bb66cbbc8916f41836adb38346 Mon Sep 17 00:00:00 2001 From: Peter Ujfalusi Date: Tue, 27 Oct 2026 10:38:40 +0200 Subject: [PATCH 3/3] ASoC: hdac_hda: Balance the runtime PM disable in codec remove hdac_hda_codec_remove() disables runtime PM of the codec device before releasing the HDA link and calling the codec driver's remove callback, so that no runtime resume can race with the teardown and access the link or the already freed codec driver data. snd_hda_codec_cleanup_for_unbind() then disables runtime PM again. On the next probe snd_hda_codec_register() enables runtime PM only once, leaving it disabled after the ASoC card or the codec driver has been unbound and bound again: the codec stays powered and runtime_status reads 'unsupported'. Re-enable runtime PM at the end of hdac_hda_codec_remove() to balance its own disable. The codec remains disabled until it is registered again. Fixes: c3ec8ac82105 ("ASoC: hdac_hda: fix memleak on module unload") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20261027083840.28813-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown --- sound/soc/codecs/hdac_hda.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c index cae5711e979c..bd4b113401a8 100644 --- a/sound/soc/codecs/hdac_hda.c +++ b/sound/soc/codecs/hdac_hda.c @@ -554,6 +554,7 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component) return; } + /* prevent runtime PM callbacks while the link and the codec are torn down */ pm_runtime_disable(&hdev->dev); snd_hdac_ext_bus_link_put(hdev->bus, hlink); @@ -561,6 +562,9 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component) driver->ops->remove(codec); snd_hda_codec_cleanup_for_unbind(codec); + + /* Balances the disable above, cleanup_for_unbind keeps runtime PM disabled */ + pm_runtime_enable(&hdev->dev); } static const struct snd_soc_dapm_route hdac_hda_dapm_routes[] = {