Re: [PATCH] ALSA: hda: intel: Don't free card in the probe work

[Takashi Iwai]

On Sun, 11 Oct 2026 22:06:27 +0200,
Ali Ahmet Memiş wrote:
> 
> If the delayed probe fails, azx_probe_work() frees the card and clears
> the drvdata. azx_remove() reads the card before it waits for the probe
> work with cancel_delayed_work_sync() so when the device is removed while
> the probe work is running, it frees the card again after the work has
> already freed it.
> 
> Leave the card to azx_remove() and only mark the probe as failed in the
> work as is done in the vga_switcheroo path.
> 
> Fixes: 39173303c838 ("ALSA: hda: Free card instance properly at probe errors")
> Reported-by: syzbot+40b06a86af225236fdb4@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=40b06a86af225236fdb4
> Signed-off-by: Ali Ahmet Memiş <aliamemis@xxxxxxxxxxx>

I believe this may change the behavior visible on user-space, and it's
not what we want.

For avoiding the card free, can it be the refcounting like below
instead?


thanks,

Takashi

--- a/sound/hda/controllers/intel.c
+++ b/sound/hda/controllers/intel.c
@@ -1737,7 +1737,11 @@ static void azx_check_snoop_available(struct azx *chip)
 static void azx_probe_work(struct work_struct *work)
 {
 	struct hda_intel *hda = container_of(work, struct hda_intel, probe_work.work);
+	struct snd_card *card = hda->core.card;
+
+	get_device(&card->card_dev);
 	azx_probe_continue(&hda->chip, true);
+	put_device(&card->card_dev);
 }
 
 static int default_bdl_pos_adj(struct azx *chip)