Commit eb8d0eaa authored by Takashi Iwai's avatar Takashi Iwai

ALSA: hda: Fix potential race at unregistration and unsol events

When the codec device is unregistered / freed, it may release the
resource while being used in an unsolicited event like the jack
detection work.  This leads to use-after-free.

The fix here is to unregister the device at first, i.e. removing the
codec from the list, then flushing the pending works to assure that
all unsol events are gone.  After this point, we're free from
accessing the codec via unsol events, thus can release the resources
gracefully.

The issue was spotted originally by Intel CI, but it couldn't be
reproduced reliably by its nature.  So let's hope this fix really
addresses the whole issues.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196045Reported-by: default avatarMartin Peres <martin.peres@free.fr>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent a4b4793f
...@@ -212,5 +212,6 @@ void snd_hdac_bus_remove_device(struct hdac_bus *bus, ...@@ -212,5 +212,6 @@ void snd_hdac_bus_remove_device(struct hdac_bus *bus,
bus->caddr_tbl[codec->addr] = NULL; bus->caddr_tbl[codec->addr] = NULL;
clear_bit(codec->addr, &bus->codec_powered); clear_bit(codec->addr, &bus->codec_powered);
bus->num_codecs--; bus->num_codecs--;
flush_work(&bus->unsol_work);
} }
EXPORT_SYMBOL_GPL(snd_hdac_bus_remove_device); EXPORT_SYMBOL_GPL(snd_hdac_bus_remove_device);
...@@ -159,6 +159,7 @@ void snd_hdac_device_unregister(struct hdac_device *codec) ...@@ -159,6 +159,7 @@ void snd_hdac_device_unregister(struct hdac_device *codec)
if (device_is_registered(&codec->dev)) { if (device_is_registered(&codec->dev)) {
hda_widget_sysfs_exit(codec); hda_widget_sysfs_exit(codec);
device_del(&codec->dev); device_del(&codec->dev);
snd_hdac_bus_remove_device(codec->bus, codec);
} }
} }
EXPORT_SYMBOL_GPL(snd_hdac_device_unregister); EXPORT_SYMBOL_GPL(snd_hdac_device_unregister);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment