github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ASoC: codecs: hda: Stop unsol events and jack polling before codec removal

Browse Source 
The ASoC HD-audio codec driver has the same race as the legacy HDA
codec driver unbind: hda_codec_remove() calls the codec's remove
callback that releases the driver resources, followed by
snd_hda_codec_cleanup_for_unbind(), while the unsolicited event work
and the jack polling work may still run concurrently and access the
released resources, leading to a UAF.

Apply the same fix as done for the legacy driver: call
snd_hdac_device_disable_unsol() and cancel jackpoll_work at the
beginning of hda_codec_remove(), and clear the unsol_disabled flag
again at hda_codec_probe() so that the events get delivered after the
codec is re-registered.

Assisted-by: LLM
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20261007215650.159871-3-tiwai@suse.de
This commit is contained in:
Takashi Iwai 2026-10-07 23:56:47 +02:00
parent f3607b6952
commit f2c6e4f457
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sound/soc/codecs/hda.c
View File

@ -218,6 +218,9 @@ static int hda_codec_probe(struct snd_soc_component *component)
goto err;
}
/* unsol events are still blocked until registered */
codec->core.unsol_disabled = false;
ret = driver->ops->probe(codec, codec->preset);
if (ret < 0) {
dev_err(&hdev->dev, "codec init failed: %d\n", ret);
@ -276,6 +279,10 @@ static void hda_codec_remove(struct snd_soc_component *component)
/* Don't allow any more runtime suspends */
pm_runtime_forbid(&hdev->dev);
/* stop asynchronous jack handling before freeing driver resources */
snd_hdac_device_disable_unsol(hdev);
cancel_delayed_work_sync(&codec->jackpoll_work);
hda_codec_unregister_dais(codec, component);
if (driver->ops->remove)