From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B653E36C0D5 for ; Mon, 9 Mar 2026 21:54:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773093272; cv=none; b=LKH1SIRkeS2lzLe5k0WNV3zKapodf8L2ml+pCD43TRaU7L2sUSJEPAffg25Xz2bU16+RqyFBSIzHoB8wTWOO1koGnqMv3+TyXlxID/R1bGVkPxu6SzbzsBJVq0reFG5uv0dCgOhHG46y+XtAFSuzMtwL1q1PEacrqP6wZnr2pSk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773093272; c=relaxed/simple; bh=J7xl59Fx58+zXtIX029IHEauG7FA+vlkguBok7F4oUA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=FzAQsskrCPLO6mfD4Xy0H2pz4oXaYZQAXQWheX0P74lREs6GuH4qOn8paZ45XpHxSs19UGc/xYR74hSFH2y79YMzltnKrZiAsHDvPUF9Rs0aCHvSDWgXs/xOoBSr2XcAYAFAQiowVPd4KCFmphn5aQ7ARtTF+2TubZt2DRxBdjU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LzzL3Ikf; arc=none smtp.client-ip=209.85.128.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LzzL3Ikf" Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-48534b59cf3so14957295e9.2 for ; Mon, 09 Mar 2026 14:54:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1773093269; x=1773698069; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=CQJo3BgcusRLIm3SnX57c68pebl/CK3B8z7Rc9lJ4Ds=; b=LzzL3IkfrMijLyqzDN9+uZhUtb7FDvLsfo1UbJwaTUy8ZsaYCpj+Ii3lKLRp3m5YLE VXynVl7k40tovoG+w3EJMAuQH602BfzvE7sS1JHRAY7WqV3mbbVo/q8/EeB+qCFvEdnM n1HnrSa/1GhTyl4dmPc6wsDQAu27tX6zOXbOKnrivzSka8EQDlmDSY9YGQBX6SrGZE8f 9+t/NeRHhHJYjSy+OVx4Cvh8CPc/bQMCs11T2BIPrhqZCumDVRqjTdUZbz0Qt4W/Bg2H ffP2cBhsIxagXB37qmJ2vPXnjPyRkTSaZdNlnl3L/KE7eNVHsWrsec8hJnjIWl9Y6Srk 0c1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773093269; x=1773698069; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=CQJo3BgcusRLIm3SnX57c68pebl/CK3B8z7Rc9lJ4Ds=; b=RlDzC1d+xrotI82DzpCxiUEK0AlPi4ledIpKJh7UE6Liz/1XHGwNXnxb1oMG1oARiz uxn6Ar/mvLQodTYK8XUCPXEK2yp7Rf/gEhWJzTFVir2bIupNEaRUCsFhwR73Hagc07uz mZdXjfT8cITLT9Gt2jjZ401bx9XVPa7/Z23ZV+xk7G/0IWMeTQ7w7jrgQ+ARz4fSAmMm 2OYxqaV0Wg3ANMrNsSSQGJkgqQOiqVGx5AC7fIZpZNtRHJNzt6gRcd9QECkRIs7RPtqN wjz4N7weI/AGp4AR8u7RLeElc8+WYgWCvPnZnQ13/57dN1PiGZAJWfgo7x9tRVQZVOIh +mzw== X-Forwarded-Encrypted: i=1; AJvYcCUNUExZK1tGcNsSOiEcQGSd+CU2aZ8H1Au1bMtycAZO9pIwhyf6i9I4SZ0GGeih9p/rBX2K4VSKCflYifU=@vger.kernel.org X-Gm-Message-State: AOJu0Yw4ZcHPyMFV2wm7xs1GX4OGNTI+l81jLgt9MXt6GCO57tXuFsUO 0GuK6JruzLVu7oF+l0NE78BNUcnJeBNUasXeGBkg+bITY26V6YTL0HQ= X-Gm-Gg: ATEYQzzSawOrKN8hwMa6yobb2XziGkCPww+31WCgKC+PhoRmj5bsS2cOnsOc+zL4NLL xwSzHwSNsSSBKiP3GCo5/HFFjmVvufeP/WhimiLXwk/yWYpJg/bzqzIEP3399BZrIc5xBgf20AN adJW8HAZm/GSgVzuD2oeY9rBbAwngpBWbEL6WYevpLD1tcseK4a05eiZK2pwM9+HZHzAo70Tpo0 hWVv1Ls1Ccc9NegPawiPBC7jgRUcdZv6hxOBjbfB+6cVLe+y9TsT+1ATrFgIhq3njSY1dYIHrwx wEDe2cJgTDr/7ruG0NSzovffqcLQgW8rbArDMBPL/+RdmlAR/wqb2KPMGpLEFwdt394nqZrNkwc aSUbOOkX0fWVmXsP5PpFDv7AOOqh3sQN4LKocl3HMbABxMIa0Qta+/G5dCe0YkBNJS15uLhpHoZ Rx7J8yibH62ChDhnkTnZBaD3zRiZUiXDcOk2P6LPo0HKFjmITTtYoXVw== X-Received: by 2002:a05:600c:b93:b0:483:badb:618e with SMTP id 5b1f17b1804b1-48526923941mr208200345e9.8.1773093268946; Mon, 09 Mar 2026 14:54:28 -0700 (PDT) Received: from localhost.localdomain ([2a01:e11:2401:e440:4d43:1ae9:c232:cc4d]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48541a900easm28183845e9.9.2026.03.09.14.54.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Mar 2026 14:54:28 -0700 (PDT) From: "matteo.cotifava" To: broonie@kernel.org Cc: cotifavamatteo@gmail.com, cujomalainey@chromium.org, lgirdwood@gmail.com, linux-kernel@vger.kernel.org, linux-sound@vger.kernel.org, perex@perex.cz, srini@kernel.org, tiwai@suse.com Subject: [PATCH v2 0/2] ASoC: soc-core: fix use-after-free in close_delayed_work Date: Mon, 9 Mar 2026 22:54:10 +0100 Message-Id: <20260309215412.545628-1-cotifavamatteo@gmail.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <17591222-b9f7-4056-9c13-4a2ccd0788df@sirena.org.uk> References: <17591222-b9f7-4056-9c13-4a2ccd0788df@sirena.org.uk> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Fix a use-after-free in snd_soc_dapm_stream_event() triggered when a sound card is unbound while a PCM close delayed work is pending. As Mark pointed out in v1 review, flush_delayed_work() does handle pending timers correctly. The actual issue appears to be new work getting scheduled after the flush: snd_card_disconnect_sync() inside soc_cleanup_card_resources() can trigger PCM closes which call snd_soc_dapm_stream_stop(), scheduling new delayed work after the flush in snd_soc_unbind_card() has already completed. If the timer fires after soc_remove_link_components() frees the DAPM widgets, the work accesses freed memory. v1 -> v2: - Split into two patches as requested - Dropped cancel_delayed_work_sync() approach, kept flush as suggested - Added a flush in soc_cleanup_card_resources() after disconnect_sync (so no new work can be scheduled) and before DAIs/widgets are freed matteo.cotifava (2): ASoC: soc-core: drop delayed_work_pending() check before flush ASoC: soc-core: flush delayed work before removing DAIs and widgets sound/soc/soc-core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.39.5