From f2c6e4f4575ff5318865c77da0153eb64809e8b8 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Wed, 7 Oct 2026 23:56:47 +0200 Subject: [PATCH] ASoC: codecs: hda: Stop unsol events and jack polling before codec removal The ASoC HD-audio codec driver has the same race as the legacy HDA codec driver unbind: hda_codec_remove() calls the codec's remove callback that releases the driver resources, followed by snd_hda_codec_cleanup_for_unbind(), while the unsolicited event work and the jack polling work may still run concurrently and access the released resources, leading to a UAF. Apply the same fix as done for the legacy driver: call snd_hdac_device_disable_unsol() and cancel jackpoll_work at the beginning of hda_codec_remove(), and clear the unsol_disabled flag again at hda_codec_probe() so that the events get delivered after the codec is re-registered. Assisted-by: LLM Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20261007215650.159871-3-tiwai@suse.de --- sound/soc/codecs/hda.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sound/soc/codecs/hda.c b/sound/soc/codecs/hda.c index 237b0b060457..5188c9d74c8b 100644 --- a/sound/soc/codecs/hda.c +++ b/sound/soc/codecs/hda.c @@ -218,6 +218,9 @@ static int hda_codec_probe(struct snd_soc_component *component) goto err; } + /* unsol events are still blocked until registered */ + codec->core.unsol_disabled = false; + ret = driver->ops->probe(codec, codec->preset); if (ret < 0) { dev_err(&hdev->dev, "codec init failed: %d\n", ret); @@ -276,6 +279,10 @@ static void hda_codec_remove(struct snd_soc_component *component) /* Don't allow any more runtime suspends */ pm_runtime_forbid(&hdev->dev); + /* stop asynchronous jack handling before freeing driver resources */ + snd_hdac_device_disable_unsol(hdev); + cancel_delayed_work_sync(&codec->jackpoll_work); + hda_codec_unregister_dais(codec, component); if (driver->ops->remove)