Unverified Commit 95bc5c22 authored by matteo.cotifava's avatar matteo.cotifava Committed by Mark Brown
Browse files

ASoC: soc-core: flush delayed work before removing DAIs and widgets 



When a sound card is unbound while a PCM stream is open, a
use-after-free can occur in snd_soc_dapm_stream_event(), called from
the close_delayed_work workqueue handler.

During unbind, snd_soc_unbind_card() flushes delayed work and then
calls soc_cleanup_card_resources(). Inside cleanup,
snd_card_disconnect_sync() releases all PCM file descriptors, and
the resulting PCM close path can call snd_soc_dapm_stream_stop()
which schedules new delayed work with a pmdown_time timer delay.
Since this happens after the flush in snd_soc_unbind_card(), the
new work is not caught. soc_remove_link_components() then frees
DAPM widgets before this work fires, leading to the use-after-free.

The existing flush in soc_free_pcm_runtime() also cannot help as it
runs after soc_remove_link_components() has already freed the widgets.

Add a flush in soc_cleanup_card_resources() after
snd_card_disconnect_sync() (after which no new PCM closes can
schedule further delayed work) and before soc_remove_link_dais()
and soc_remove_link_components() (which tear down the structures the
delayed work accesses).

Fixes: e894efef ("ASoC: core: add support to card rebind")
Signed-off-by: default avatarMatteo Cotifava <cotifavamatteo@gmail.com>
Link: https://patch.msgid.link/20260309215412.545628-3-cotifavamatteo@gmail.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 3c99c9f0

sound/soc/soc-core.c

+3 −0
Original line number Diff line number Diff line
@@ -2121,6 +2121,9 @@ static void soc_cleanup_card_resources(struct snd_soc_card *card) 
	for_each_card_rtds(card, rtd)

		if (rtd->initialized)

			snd_soc_link_exit(rtd);

	/* flush delayed work before removing DAIs and DAPM widgets */

	snd_soc_flush_all_delayed_work(card);



	/* remove and free each DAI */

	soc_remove_link_dais(card);

	soc_remove_link_components(card);