[PATCH 0/3] ALSA/ASoC: hda: Fix race between unsol events and unbind

[PATCH 0/3] ALSA/ASoC: hda: Fix race between unsol events and unbind

[Takashi Iwai]

Here is another series of small fixes for HD-audio, beginning with the
fix for an issue reported by Sashiko, and extended the fixes to ASoC
HD-audio and a potential improvement that were spotted during the
development of the first patch.


Takashi

===

Takashi Iwai (3):
  ALSA: hda: Stop unsol events and jack polling before codec unbind
  ASoC: codecs: hda: Stop unsol events and jack polling before codec
    removal
  ALSA: hda: Make hdac_device.registered a plain bool

 include/sound/hdaudio.h  |  4 +++-
 sound/hda/common/bind.c  |  7 +++++++
 sound/hda/common/codec.c |  4 ++--
 sound/hda/core/bus.c     | 21 ++++++++++++++++++++-
 sound/soc/codecs/hda.c   |  7 +++++++
 5 files changed, 39 insertions(+), 4 deletions(-)

-- 
2.55.0

[PATCH 1/3] ALSA: hda: Stop unsol events and jack polling before codec unbind

[Takashi Iwai]

At unbinding a codec driver, hda_codec_driver_remove() calls the
codec's remove callback that releases the driver resources, followed
by snd_hda_codec_cleanup_for_unbind().  Meanwhile, the unsolicited
events are processed asynchronously in bus->unsol_work, and
snd_hdac_bus_process_unsol_events() checks only codec->registered flag
before calling the driver's unsol_event callback without the lock.
Since codec->registered is cleared only in
snd_hda_codec_cleanup_for_unbind(), and there is no flush of the unsol
work at unbinding, the unsol event handler may run concurrently during
the running remove callback, which may lead to a UAF.  The same
problem applies to the jack polling work, which is canceled only after
the remove callback.

For addressing those races, introduce a new flag unsol_disabled to
hdac_device, to be checked it in the unsol event worker, while a new
helper snd_hdac_device_disable_unsol() sets this flag and flushes the
pending unsol work.  The helper is called at hda_codec_driver_remove()
together with the cancel of jackpoll_work to assure that no
asynchronous jack handling can run.  The flag is cleared again at
probing the codec driver, while the events are still blocked by the
registered flag until the codec gets registered.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Assisted-by: LLM
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 include/sound/hdaudio.h |  2 ++
 sound/hda/common/bind.c |  7 +++++++
 sound/hda/core/bus.c    | 21 ++++++++++++++++++++-
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/include/sound/hdaudio.h b/include/sound/hdaudio.h
index 4cbbb1744740..285f7c4d262d 100644
--- a/include/sound/hdaudio.h
+++ b/include/sound/hdaudio.h
@@ -97,6 +97,7 @@ struct hdac_device {
 	bool caps_overwriting:1; /* caps overwrite being in process */
 	bool cache_coef:1;	/* cache COEF read/write too */
 	unsigned int registered:1; /* codec was registered */
+	bool unsol_disabled;	/* unsol events blocked; protected by bus->reg_lock */
 };
 
 /* device/driver type used for matching */
@@ -123,6 +124,7 @@ int snd_hdac_device_init(struct hdac_device *dev, struct hdac_bus *bus,
 			 const char *name, unsigned int addr);
 void snd_hdac_device_exit(struct hdac_device *dev);
 int snd_hdac_device_register(struct hdac_device *codec);
+void snd_hdac_device_disable_unsol(struct hdac_device *codec);
 void snd_hdac_device_unregister(struct hdac_device *codec);
 int snd_hdac_device_set_chip_name(struct hdac_device *codec, const char *name);
 int snd_hdac_codec_modalias(const struct hdac_device *hdac, char *buf, size_t size);
diff --git a/sound/hda/common/bind.c b/sound/hda/common/bind.c
index 6a728a773556..4772ca154a29 100644
--- a/sound/hda/common/bind.c
+++ b/sound/hda/common/bind.c
@@ -100,6 +100,9 @@ static int hda_codec_driver_probe(struct device *dev)
 	if (WARN_ON(!codec->preset))
 		return -EINVAL;
 
+	/* unsol events are still blocked until registered */
+	codec->core.unsol_disabled = false;
+
 	err = snd_hda_codec_set_name(codec, codec->preset->name);
 	if (err < 0)
 		goto error;
@@ -160,6 +163,10 @@ static int hda_codec_driver_remove(struct device *dev)
 		return codec->bus->core.ext_ops->hdev_detach(&codec->core);
 	}
 
+	/* stop asynchronous jack handling before freeing driver resources */
+	snd_hdac_device_disable_unsol(&codec->core);
+	cancel_delayed_work_sync(&codec->jackpoll_work);
+
 	snd_hda_codec_disconnect_pcms(codec);
 	snd_hda_jack_tbl_disconnect(codec);
 	snd_refcount_sync(&codec->pcm_ref);
diff --git a/sound/hda/core/bus.c b/sound/hda/core/bus.c
index 20fe1c4a2977..8d4ed9834aaa 100644
--- a/sound/hda/core/bus.c
+++ b/sound/hda/core/bus.c
@@ -180,7 +180,7 @@ static void snd_hdac_bus_process_unsol_events(struct work_struct *work)
 		if (!(caddr & (1 << 4))) /* no unsolicited event? */
 			continue;
 		codec = bus->caddr_tbl[caddr & 0x0f];
-		if (!codec || !codec->registered)
+		if (!codec || !codec->registered || codec->unsol_disabled)
 			continue;
 		spin_unlock_irq(&bus->reg_lock);
 		drv = drv_to_hdac_driver(codec->dev.driver);
@@ -191,6 +191,25 @@ static void snd_hdac_bus_process_unsol_events(struct work_struct *work)
 	spin_unlock_irq(&bus->reg_lock);
 }
 
+/**
+ * snd_hdac_device_disable_unsol - block and flush unsol events for the codec
+ * @codec: the HDA core device
+ *
+ * Stop dispatching the unsolicited events to the given codec, and wait for
+ * the pending unsol event handler to finish.  Called at unbinding the codec
+ * driver before releasing the driver resources.
+ */
+void snd_hdac_device_disable_unsol(struct hdac_device *codec)
+{
+	struct hdac_bus *bus = codec->bus;
+
+	spin_lock_irq(&bus->reg_lock);
+	codec->unsol_disabled = true;
+	spin_unlock_irq(&bus->reg_lock);
+	flush_work(&bus->unsol_work);
+}
+EXPORT_SYMBOL_GPL(snd_hdac_device_disable_unsol);
+
 /**
  * snd_hdac_bus_add_device - Add a codec to bus
  * @bus: HDA core bus
-- 
2.55.0

Re: [PATCH 1/3] ALSA: hda: Stop unsol events and jack polling before codec unbind

[Cezary Rojewski]

On 10/7/2026 11:56 PM, Takashi Iwai wrote:
> At unbinding a codec driver, hda_codec_driver_remove() calls the
> codec's remove callback that releases the driver resources, followed
> by snd_hda_codec_cleanup_for_unbind().  Meanwhile, the unsolicited
> events are processed asynchronously in bus->unsol_work, and
> snd_hdac_bus_process_unsol_events() checks only codec->registered flag
> before calling the driver's unsol_event callback without the lock.
> Since codec->registered is cleared only in
> snd_hda_codec_cleanup_for_unbind(), and there is no flush of the unsol
> work at unbinding, the unsol event handler may run concurrently during
> the running remove callback, which may lead to a UAF.  The same
> problem applies to the jack polling work, which is canceled only after
> the remove callback.

> +++ b/sound/hda/common/bind.c
> @@ -100,6 +100,9 @@ static int hda_codec_driver_probe(struct device *dev)
>  	if (WARN_ON(!codec->preset))
>  		return -EINVAL;
>  
> +	/* unsol events are still blocked until registered */
> +	codec->core.unsol_disabled = false;
> +
>  	err = snd_hda_codec_set_name(codec, codec->preset->name);
>  	if (err < 0)
>  		goto error;
> @@ -160,6 +163,10 @@ static int hda_codec_driver_remove(struct device *dev)
>  		return codec->bus->core.ext_ops->hdev_detach(&codec->core);
>  	}
>  
> +	/* stop asynchronous jack handling before freeing driver resources */
> +	snd_hdac_device_disable_unsol(&codec->core);
> +	cancel_delayed_work_sync(&codec->jackpoll_work);


IMHO this is a proof that ->registered flag doesn't do its job.
snd_hda_codec_cleanup_for_unbind() is called right after and it does
contain cancel_delayed_work_sync(&codec->jackpoll_work).  It does
contain snd_hda_codec_disconnect_pcms() and
snd_hda_jack_tbl_disconnect() operations too.

I'd say it is snd_hda_codec_cleanup_for_unbind() that needs an update
and perhaps be responsible for calling driver->remove() too.

> +
>  	snd_hda_codec_disconnect_pcms(codec);
>  	snd_hda_jack_tbl_disconnect(codec);
>  	snd_refcount_sync(&codec->pcm_ref);

Re: [PATCH 1/3] ALSA: hda: Stop unsol events and jack polling before codec unbind

[Takashi Iwai]

On Thu, 08 Oct 2026 11:08:13 +0200,
Cezary Rojewski wrote:
> 
> On 10/7/2026 11:56 PM, Takashi Iwai wrote:
> > At unbinding a codec driver, hda_codec_driver_remove() calls the
> > codec's remove callback that releases the driver resources, followed
> > by snd_hda_codec_cleanup_for_unbind().  Meanwhile, the unsolicited
> > events are processed asynchronously in bus->unsol_work, and
> > snd_hdac_bus_process_unsol_events() checks only codec->registered flag
> > before calling the driver's unsol_event callback without the lock.
> > Since codec->registered is cleared only in
> > snd_hda_codec_cleanup_for_unbind(), and there is no flush of the unsol
> > work at unbinding, the unsol event handler may run concurrently during
> > the running remove callback, which may lead to a UAF.  The same
> > problem applies to the jack polling work, which is canceled only after
> > the remove callback.
> 
> > +++ b/sound/hda/common/bind.c
> > @@ -100,6 +100,9 @@ static int hda_codec_driver_probe(struct device *dev)
> >  	if (WARN_ON(!codec->preset))
> >  		return -EINVAL;
> >  
> > +	/* unsol events are still blocked until registered */
> > +	codec->core.unsol_disabled = false;
> > +
> >  	err = snd_hda_codec_set_name(codec, codec->preset->name);
> >  	if (err < 0)
> >  		goto error;
> > @@ -160,6 +163,10 @@ static int hda_codec_driver_remove(struct device *dev)
> >  		return codec->bus->core.ext_ops->hdev_detach(&codec->core);
> >  	}
> >  
> > +	/* stop asynchronous jack handling before freeing driver resources */
> > +	snd_hdac_device_disable_unsol(&codec->core);
> > +	cancel_delayed_work_sync(&codec->jackpoll_work);
> 
> 
> IMHO this is a proof that ->registered flag doesn't do its job.
> snd_hda_codec_cleanup_for_unbind() is called right after and it does
> contain cancel_delayed_work_sync(&codec->jackpoll_work).  It does
> contain snd_hda_codec_disconnect_pcms() and
> snd_hda_jack_tbl_disconnect() operations too.

It's about the pending works, and the flag doesn't help there alone
unless they are synchronized; at the time point you flip the flag, the
work might be already in-flight, so the flag switch may miss the
chances.

> I'd say it is snd_hda_codec_cleanup_for_unbind() that needs an update
> and perhaps be responsible for calling driver->remove() too.

Yeah, some code reorganization would be good.


thanks,

Takashi

Re: [PATCH 1/3] ALSA: hda: Stop unsol events and jack polling before codec unbind

[Cezary Rojewski]

On 10/8/2026 12:16 PM, Takashi Iwai wrote:
> On Thu, 08 Oct 2026 11:08:13 +0200,
> Cezary Rojewski wrote:
>>
>> On 10/7/2026 11:56 PM, Takashi Iwai wrote:

>>> +++ b/sound/hda/common/bind.c
>>> @@ -100,6 +100,9 @@ static int hda_codec_driver_probe(struct device *dev)
>>>  	if (WARN_ON(!codec->preset))
>>>  		return -EINVAL;
>>>  
>>> +	/* unsol events are still blocked until registered */
>>> +	codec->core.unsol_disabled = false;
>>> +
>>>  	err = snd_hda_codec_set_name(codec, codec->preset->name);
>>>  	if (err < 0)
>>>  		goto error;
>>> @@ -160,6 +163,10 @@ static int hda_codec_driver_remove(struct device *dev)
>>>  		return codec->bus->core.ext_ops->hdev_detach(&codec->core);
>>>  	}
>>>  
>>> +	/* stop asynchronous jack handling before freeing driver resources */
>>> +	snd_hdac_device_disable_unsol(&codec->core);
>>> +	cancel_delayed_work_sync(&codec->jackpoll_work);
>>
>>
>> IMHO this is a proof that ->registered flag doesn't do its job.
>> snd_hda_codec_cleanup_for_unbind() is called right after and it does
>> contain cancel_delayed_work_sync(&codec->jackpoll_work).  It does
>> contain snd_hda_codec_disconnect_pcms() and
>> snd_hda_jack_tbl_disconnect() operations too.
> 
> It's about the pending works, and the flag doesn't help there alone
> unless they are synchronized; at the time point you flip the flag, the
> work might be already in-flight, so the flag switch may miss the
> chances.

I agree, my suggestion was to make ->registered the sole owner of the
subject, including the synchronization. At the same time, fixing the
problem first and expanding the work later is also a valid approach.

Do you have a method for reproducing the problem easily?

>> I'd say it is snd_hda_codec_cleanup_for_unbind() that needs an update
>> and perhaps be responsible for calling driver->remove() too.
> 
> Yeah, some code reorganization would be good.

Re: [PATCH 1/3] ALSA: hda: Stop unsol events and jack polling before codec unbind

[Takashi Iwai]

On Thu, 08 Oct 2026 13:52:42 +0200,
Cezary Rojewski wrote:
> 
> On 10/8/2026 12:16 PM, Takashi Iwai wrote:
> > On Thu, 08 Oct 2026 11:08:13 +0200,
> > Cezary Rojewski wrote:
> >>
> >> On 10/7/2026 11:56 PM, Takashi Iwai wrote:
> 
> >>> +++ b/sound/hda/common/bind.c
> >>> @@ -100,6 +100,9 @@ static int hda_codec_driver_probe(struct device *dev)
> >>>  	if (WARN_ON(!codec->preset))
> >>>  		return -EINVAL;
> >>>  
> >>> +	/* unsol events are still blocked until registered */
> >>> +	codec->core.unsol_disabled = false;
> >>> +
> >>>  	err = snd_hda_codec_set_name(codec, codec->preset->name);
> >>>  	if (err < 0)
> >>>  		goto error;
> >>> @@ -160,6 +163,10 @@ static int hda_codec_driver_remove(struct device *dev)
> >>>  		return codec->bus->core.ext_ops->hdev_detach(&codec->core);
> >>>  	}
> >>>  
> >>> +	/* stop asynchronous jack handling before freeing driver resources */
> >>> +	snd_hdac_device_disable_unsol(&codec->core);
> >>> +	cancel_delayed_work_sync(&codec->jackpoll_work);
> >>
> >>
> >> IMHO this is a proof that ->registered flag doesn't do its job.
> >> snd_hda_codec_cleanup_for_unbind() is called right after and it does
> >> contain cancel_delayed_work_sync(&codec->jackpoll_work).  It does
> >> contain snd_hda_codec_disconnect_pcms() and
> >> snd_hda_jack_tbl_disconnect() operations too.
> > 
> > It's about the pending works, and the flag doesn't help there alone
> > unless they are synchronized; at the time point you flip the flag, the
> > work might be already in-flight, so the flag switch may miss the
> > chances.
> 
> I agree, my suggestion was to make ->registered the sole owner of the
> subject, including the synchronization. At the same time, fixing the
> problem first and expanding the work later is also a valid approach.
> 
> Do you have a method for reproducing the problem easily?

No, it's currently only hypothetical.
I guess it can be done with userfaltd, though.  Maybe AI can help for
creating a reproducer.

> >> I'd say it is snd_hda_codec_cleanup_for_unbind() that needs an update
> >> and perhaps be responsible for calling driver->remove() too.
> > 
> > Yeah, some code reorganization would be good.

Looking forward to seeing patches! ;)


Takashi

[PATCH 2/3] ASoC: codecs: hda: Stop unsol events and jack polling before codec removal

[Takashi Iwai]

The ASoC HD-audio codec driver has the same race as the legacy HDA
codec driver unbind: hda_codec_remove() calls the codec's remove
callback that releases the driver resources, followed by
snd_hda_codec_cleanup_for_unbind(), while the unsolicited event work
and the jack polling work may still run concurrently and access the
released resources, leading to a UAF.

Apply the same fix as done for the legacy driver: call
snd_hdac_device_disable_unsol() and cancel jackpoll_work at the
beginning of hda_codec_remove(), and clear the unsol_disabled flag
again at hda_codec_probe() so that the events get delivered after the
codec is re-registered.

Assisted-by: LLM
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/soc/codecs/hda.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sound/soc/codecs/hda.c b/sound/soc/codecs/hda.c
index 237b0b060457..5188c9d74c8b 100644
--- a/sound/soc/codecs/hda.c
+++ b/sound/soc/codecs/hda.c
@@ -218,6 +218,9 @@ static int hda_codec_probe(struct snd_soc_component *component)
 		goto err;
 	}
 
+	/* unsol events are still blocked until registered */
+	codec->core.unsol_disabled = false;
+
 	ret = driver->ops->probe(codec, codec->preset);
 	if (ret < 0) {
 		dev_err(&hdev->dev, "codec init failed: %d\n", ret);
@@ -276,6 +279,10 @@ static void hda_codec_remove(struct snd_soc_component *component)
 	/* Don't allow any more runtime suspends */
 	pm_runtime_forbid(&hdev->dev);
 
+	/* stop asynchronous jack handling before freeing driver resources */
+	snd_hdac_device_disable_unsol(hdev);
+	cancel_delayed_work_sync(&codec->jackpoll_work);
+
 	hda_codec_unregister_dais(codec, component);
 
 	if (driver->ops->remove)
-- 
2.55.0

[PATCH 3/3] ALSA: hda: Make hdac_device.registered a plain bool

[Takashi Iwai]

The registered field of hdac_device is a bitfield sharing the same
word with other bitfields like lazy_cache, and those are updated in a
non-atomic read-modify-write manner without any lock.  Meanwhile, the
registered flag is read from the unsolicited event worker
concurrently, so the concurrent updates of the neighboring bitfields
may race with it.

Convert it to a plain bool for avoiding such a subtle race.  Also
replace the assignments of 0/1 with false/true accordingly.

Assisted-by: LLM
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 include/sound/hdaudio.h  | 2 +-
 sound/hda/common/codec.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/sound/hdaudio.h b/include/sound/hdaudio.h
index 285f7c4d262d..04fd4794bcee 100644
--- a/include/sound/hdaudio.h
+++ b/include/sound/hdaudio.h
@@ -96,7 +96,7 @@ struct hdac_device {
 	bool lazy_cache:1;	/* don't wake up for writes */
 	bool caps_overwriting:1; /* caps overwrite being in process */
 	bool cache_coef:1;	/* cache COEF read/write too */
-	unsigned int registered:1; /* codec was registered */
+	bool registered;	/* codec was registered */
 	bool unsol_disabled;	/* unsol events blocked; protected by bus->reg_lock */
 };
 
diff --git a/sound/hda/common/codec.c b/sound/hda/common/codec.c
index b79346d01021..c99fe61c29db 100644
--- a/sound/hda/common/codec.c
+++ b/sound/hda/common/codec.c
@@ -761,7 +761,7 @@ void snd_hda_codec_cleanup_for_unbind(struct hda_codec *codec)
 		/* pm_runtime_put() is called in snd_hdac_device_exit() */
 		pm_runtime_get_noresume(hda_codec_dev(codec));
 		pm_runtime_disable(hda_codec_dev(codec));
-		codec->core.registered = 0;
+		codec->core.registered = false;
 	}
 
 	snd_hda_codec_disconnect_pcms(codec);
@@ -815,7 +815,7 @@ void snd_hda_codec_register(struct hda_codec *codec)
 		pm_runtime_enable(hda_codec_dev(codec));
 		/* it was powered up in snd_hda_codec_new(), now all done */
 		snd_hda_power_down(codec);
-		codec->core.registered = 1;
+		codec->core.registered = true;
 	}
 }
 EXPORT_SYMBOL_GPL(snd_hda_codec_register);
-- 
2.55.0