[PATCH] ALSA: hda: Avoid dev_err() at probe error in vga_switcheroo handler

[PATCH] ALSA: hda: Avoid dev_err() at probe error in vga_switcheroo handler

[Takashi Iwai]

The vga_switcheroo handler azx_vs_set_state() calls
azx_probe_contine() for enabling the audio, and if an error happens
during the probe, azx_probe_continue() releases its associated sound
card object at the error path.  In return, azx_vs_set_state() tries to
show an error via dev_err() with the card's device pointer, but since
the card object is already gone, this can lead to a UAF.

For avoiding the unneeded crash, replace the device for the error
message with the original PCI device that is passed to
azx_vx_set_state() itself.

Fixes: 39173303c838 ("ALSA: hda: Free card instance properly at probe errors")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/hda/controllers/intel.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/sound/hda/controllers/intel.c b/sound/hda/controllers/intel.c
index 24015c73a67f..0e47f7f0947c 100644
--- a/sound/hda/controllers/intel.c
+++ b/sound/hda/controllers/intel.c
@@ -1211,8 +1211,14 @@ static void azx_vs_set_state(struct pci_dev *pci,
 		if (!disabled) {
 			dev_info(chip->card->dev,
 				 "Start delayed initialization\n");
-			if (azx_probe_continue(chip) < 0)
-				dev_err(chip->card->dev, "initialization error\n");
+			if (azx_probe_continue(chip) < 0) {
+				/* since the HD-audio driver got unbound /
+				 * released upon error, we can't use card device
+				 * any longer, so use pci device directly
+				 */
+				dev_err(&pci->dev, "%s: initialization error\n",
+					__func__);
+			}
 		}
 	} else {
 		dev_info(chip->card->dev, "%s via vga_switcheroo\n",
-- 
2.55.0

Re: [PATCH] ALSA: hda: Avoid dev_err() at probe error in vga_switcheroo handler

[Takashi Iwai]

On Wed, 07 Oct 2026 23:37:25 +0200,
Takashi Iwai wrote:
> 
> The vga_switcheroo handler azx_vs_set_state() calls
> azx_probe_contine() for enabling the audio, and if an error happens
> during the probe, azx_probe_continue() releases its associated sound
> card object at the error path.  In return, azx_vs_set_state() tries to
> show an error via dev_err() with the card's device pointer, but since
> the card object is already gone, this can lead to a UAF.
> 
> For avoiding the unneeded crash, replace the device for the error
> message with the original PCI device that is passed to
> azx_vx_set_state() itself.
> 
> Fixes: 39173303c838 ("ALSA: hda: Free card instance properly at probe errors")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Signed-off-by: Takashi Iwai <tiwai@suse.de>

Scratch this one.  It turned out that this is no fundamental fix
(although the change doesn't hurt), and we'd see a more serious
deadlock if this scenario really happens.

Will submit a better fix instead.


Takashi