Re: [PATCH] ALSA: hda: intel: Don't free card in the probe work

["Ali Ahmet Memiş" <aliamemis@disroot.org>]

On Mon, 12 Oct 2026 16:57:37 +0200, Takashi Iwai wrote:
> OK, that's a problem, indeed.  How about replacing snd_card_free()
> with *_when_closed() version that doesn't block in addition?

The work doesn't hang anymore but removing the device while the probe
work is running hits the same UAF on the first try.  azx_remove() still
gets the card before cancel_delayed_work_sync() and the put_device() in
the work frees it:

BUG: KASAN: slab-use-after-free in snd_card_free+0x148/0x160
Read of size 1 at addr ffff888007724852 by task sh/97
Call Trace:
 snd_card_free+0x148/0x160
 pci_device_remove+0xb6/0x1d0
 device_release_driver_internal+0x38d/0x540
 pci_stop_bus_device+0x122/0x170
 ...
Freed by task 30:
 kfree+0x1e8/0x5e0
 device_release+0xcf/0x3c0
 kobject_put+0x169/0x320
 azx_probe_work+0x495/0x1fa0
 process_one_work+0x937/0x1800

> Staying the card means that the card slot will be kept, then if you
> probe another card afterwards, it'll end up with assignment on another
> card slot.

What about calling snd_card_disconnect() in the work on failure?  It
releases the slot right away and the card is still freed only in
azx_remove():

	if (azx_probe_continue(&hda->chip, false) < 0) {
		hda->init_failed = 1;
		complete_all(&hda->probe_wait);
		snd_card_disconnect(hda->chip.card);
	}

With that, snd-dummy loaded after a failed probe gets card 0 and 20
rounds of the remove race were clean with KASAN.  I can send v2 if this
looks fine.