Re: [PATCH 1/3] ALSA: hda: Stop unsol events and jack polling before codec unbind

[Takashi Iwai <tiwai@suse.de>]

On Thu, 08 Oct 2026 11:08:13 +0200,
Cezary Rojewski wrote:
> 
> On 10/7/2026 11:56 PM, Takashi Iwai wrote:
> > At unbinding a codec driver, hda_codec_driver_remove() calls the
> > codec's remove callback that releases the driver resources, followed
> > by snd_hda_codec_cleanup_for_unbind().  Meanwhile, the unsolicited
> > events are processed asynchronously in bus->unsol_work, and
> > snd_hdac_bus_process_unsol_events() checks only codec->registered flag
> > before calling the driver's unsol_event callback without the lock.
> > Since codec->registered is cleared only in
> > snd_hda_codec_cleanup_for_unbind(), and there is no flush of the unsol
> > work at unbinding, the unsol event handler may run concurrently during
> > the running remove callback, which may lead to a UAF.  The same
> > problem applies to the jack polling work, which is canceled only after
> > the remove callback.
> 
> > +++ b/sound/hda/common/bind.c
> > @@ -100,6 +100,9 @@ static int hda_codec_driver_probe(struct device *dev)
> >  	if (WARN_ON(!codec->preset))
> >  		return -EINVAL;
> >  
> > +	/* unsol events are still blocked until registered */
> > +	codec->core.unsol_disabled = false;
> > +
> >  	err = snd_hda_codec_set_name(codec, codec->preset->name);
> >  	if (err < 0)
> >  		goto error;
> > @@ -160,6 +163,10 @@ static int hda_codec_driver_remove(struct device *dev)
> >  		return codec->bus->core.ext_ops->hdev_detach(&codec->core);
> >  	}
> >  
> > +	/* stop asynchronous jack handling before freeing driver resources */
> > +	snd_hdac_device_disable_unsol(&codec->core);
> > +	cancel_delayed_work_sync(&codec->jackpoll_work);
> 
> 
> IMHO this is a proof that ->registered flag doesn't do its job.
> snd_hda_codec_cleanup_for_unbind() is called right after and it does
> contain cancel_delayed_work_sync(&codec->jackpoll_work).  It does
> contain snd_hda_codec_disconnect_pcms() and
> snd_hda_jack_tbl_disconnect() operations too.

It's about the pending works, and the flag doesn't help there alone
unless they are synchronized; at the time point you flip the flag, the
work might be already in-flight, so the flag switch may miss the
chances.

> I'd say it is snd_hda_codec_cleanup_for_unbind() that needs an update
> and perhaps be responsible for calling driver->remove() too.

Yeah, some code reorganization would be good.


thanks,

Takashi