[PATCH 2/3] ASoC: codecs: hda: Stop unsol events and jack polling before codec removal

[Takashi Iwai]

The ASoC HD-audio codec driver has the same race as the legacy HDA
codec driver unbind: hda_codec_remove() calls the codec's remove
callback that releases the driver resources, followed by
snd_hda_codec_cleanup_for_unbind(), while the unsolicited event work
and the jack polling work may still run concurrently and access the
released resources, leading to a UAF.

Apply the same fix as done for the legacy driver: call
snd_hdac_device_disable_unsol() and cancel jackpoll_work at the
beginning of hda_codec_remove(), and clear the unsol_disabled flag
again at hda_codec_probe() so that the events get delivered after the
codec is re-registered.

Assisted-by: LLM
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
---
 sound/soc/codecs/hda.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sound/soc/codecs/hda.c b/sound/soc/codecs/hda.c
index 237b0b060457..5188c9d74c8b 100644
--- a/sound/soc/codecs/hda.c
+++ b/sound/soc/codecs/hda.c
@@ -218,6 +218,9 @@ static int hda_codec_probe(struct snd_soc_component *component)
 		goto err;
 	}
 
+	/* unsol events are still blocked until registered */
+	codec->core.unsol_disabled = false;
+
 	ret = driver->ops->probe(codec, codec->preset);
 	if (ret < 0) {
 		dev_err(&hdev->dev, "codec init failed: %d\n", ret);
@@ -276,6 +279,10 @@ static void hda_codec_remove(struct snd_soc_component *component)
 	/* Don't allow any more runtime suspends */
 	pm_runtime_forbid(&hdev->dev);
 
+	/* stop asynchronous jack handling before freeing driver resources */
+	snd_hdac_device_disable_unsol(hdev);
+	cancel_delayed_work_sync(&codec->jackpoll_work);
+
 	hda_codec_unregister_dais(codec, component);
 
 	if (driver->ops->remove)
-- 
2.55.0