Re: [PATCH 1/3] ALSA: hda: Stop unsol events and jack polling before codec unbind

[Cezary Rojewski <cezary.rojewski@intel.com>]

On 10/7/2026 11:56 PM, Takashi Iwai wrote:
> At unbinding a codec driver, hda_codec_driver_remove() calls the
> codec's remove callback that releases the driver resources, followed
> by snd_hda_codec_cleanup_for_unbind().  Meanwhile, the unsolicited
> events are processed asynchronously in bus->unsol_work, and
> snd_hdac_bus_process_unsol_events() checks only codec->registered flag
> before calling the driver's unsol_event callback without the lock.
> Since codec->registered is cleared only in
> snd_hda_codec_cleanup_for_unbind(), and there is no flush of the unsol
> work at unbinding, the unsol event handler may run concurrently during
> the running remove callback, which may lead to a UAF.  The same
> problem applies to the jack polling work, which is canceled only after
> the remove callback.

> +++ b/sound/hda/common/bind.c
> @@ -100,6 +100,9 @@ static int hda_codec_driver_probe(struct device *dev)
>  	if (WARN_ON(!codec->preset))
>  		return -EINVAL;
>  
> +	/* unsol events are still blocked until registered */
> +	codec->core.unsol_disabled = false;
> +
>  	err = snd_hda_codec_set_name(codec, codec->preset->name);
>  	if (err < 0)
>  		goto error;
> @@ -160,6 +163,10 @@ static int hda_codec_driver_remove(struct device *dev)
>  		return codec->bus->core.ext_ops->hdev_detach(&codec->core);
>  	}
>  
> +	/* stop asynchronous jack handling before freeing driver resources */
> +	snd_hdac_device_disable_unsol(&codec->core);
> +	cancel_delayed_work_sync(&codec->jackpoll_work);


IMHO this is a proof that ->registered flag doesn't do its job.
snd_hda_codec_cleanup_for_unbind() is called right after and it does
contain cancel_delayed_work_sync(&codec->jackpoll_work).  It does
contain snd_hda_codec_disconnect_pcms() and
snd_hda_jack_tbl_disconnect() operations too.

I'd say it is snd_hda_codec_cleanup_for_unbind() that needs an update
and perhaps be responsible for calling driver->remove() too.

> +
>  	snd_hda_codec_disconnect_pcms(codec);
>  	snd_hda_jack_tbl_disconnect(codec);
>  	snd_refcount_sync(&codec->pcm_ref);