[PATCH] ASoC: twl6040: cancel jack-detect work on component remove

[PATCH] ASoC: twl6040: cancel jack-detect work on component remove

[hyunjungg]

From: Hyunjung Ko <hj351016@gmail.com>

twl6040_remove() frees the plug IRQ but does not drain the delayed
jack-detect work that the IRQ arms, so the work can run after the
component and its devm-allocated private data have been freed.

The plug IRQ handler twl6040_audio_handler() queues hs_jack.work with a
200 ms delay, and the worker twl6040_accessory_work() dereferences the
component via container_of():

	struct twl6040_data *priv = container_of(work,
				struct twl6040_data, hs_jack.work.work);
	struct snd_soc_component *component = priv->component;
	...
	twl6040_hs_jack_report(component, hs_jack->jack, hs_jack->report);

priv is devm_kzalloc(component->dev) and is released by devres once
component removal completes. twl6040_remove() only calls
free_irq(priv->plug_irq, component); it does not cancel hs_jack.work. A
jack event that fires in the ~200 ms window before removal leaves the
delayed work queued; it then runs against the freed priv/component after
twl6040_remove() returns and devres frees priv (use-after-free).

Cancel the work after free_irq() (so the now-detached IRQ handler can no
longer re-arm it) in twl6040_remove().

Found by static analysis and code review; not tested on real hardware
(needs a TWL6040 audio codec with headset-detect wiring).

Fixes: a2d2362edf9f ("ASoC: twl6040: Add jack support for headset and handset")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 sound/soc/codecs/twl6040.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/codecs/twl6040.c b/sound/soc/codecs/twl6040.c
index 650836f..826bde1 100644
--- a/sound/soc/codecs/twl6040.c
+++ b/sound/soc/codecs/twl6040.c
@@ -1136,6 +1136,7 @@ static void twl6040_remove(struct snd_soc_component *component)
 	struct twl6040_data *priv = snd_soc_component_get_drvdata(component);
 
 	free_irq(priv->plug_irq, component);
+	cancel_delayed_work_sync(&priv->hs_jack.work);
 }
 
 static const struct snd_soc_component_driver soc_component_dev_twl6040 = {
-- 
2.43.0

Re: [PATCH] ASoC: twl6040: cancel jack-detect work on component remove

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 380 bytes --]

On Sat, Nov 07, 2026 at 11:20:06PM +0900, hyunjungg wrote:
> From: Hyunjung Ko <hj351016@gmail.com>
> 
> twl6040_remove() frees the plug IRQ but does not drain the delayed
> jack-detect work that the IRQ arms, so the work can run after the
> component and its devm-allocated private data have been freed.

This doesn't apply against current code, please check and resend.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH] ASoC: twl6040: cancel jack-detect work on component remove

[khj]

Rebased onto current ASoC and resent as v2, thanks.

2026년 11월 9일 (월) 오전 2:05, Mark Brown <broonie@kernel.org>님이 작성:
>
> On Sat, Nov 07, 2026 at 11:20:06PM +0900, hyunjungg wrote:
> > From: Hyunjung Ko <hj351016@gmail.com>
> >
> > twl6040_remove() frees the plug IRQ but does not drain the delayed
> > jack-detect work that the IRQ arms, so the work can run after the
> > component and its devm-allocated private data have been freed.
>
> This doesn't apply against current code, please check and resend.