[PATCH v1 0/2] ASoC: amd: Fix borrowed ACPI codec device references

[Yibo Tan]

Two AMD machine drivers obtain a borrowed physical device pointer from
acpi_get_first_physical_node() and later treat it as owned. The ES8336 driver
drops it on GPIO defer. The ACP3x driver drops it on private-data OOM and
otherwise stores it for later use.

The patches convert both sites to the newer owned helper. Their reference
scope differs: ES8336 uses the device only within late probe, while ACP3x
publishes the pointer and ties the credit to card-device devres teardown.

Both defects reproduce on current mainline with direct calls to the real
static callbacks and normal ACPI/device-core unregister. In both cases the
vulnerable arm reports a KASAN slab-use-after-free in device_del(), while the
corresponding patched arm preserves the injected error and teardown with no
KASAN, WARNING, Oops or panic.

The validation does not emulate a complete ASoC production pipeline and was
not run on physical AMD/Huawei hardware.

Assisted-by: LLM

Yibo Tan (2):
  ASoC: amd: acp-es8336: Use an owned codec device reference
  ASoC: amd: acp3x-es83xx: Keep an owned codec device reference

 sound/soc/amd/acp-es8336.c                    |  5 ++---
 sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c | 13 ++++++++++++-
 2 files changed, 14 insertions(+), 4 deletions(-)


base-commit: 0ed6f7f62318a581fe9698f8a4e98c7ca01160e4
-- 
2.39.5