[PATCH] ASoC: ak4613: cancel dummy write work on component removal

[Hyunjung Ko]

ak4613_dai_trigger() schedules priv->dummy_write_work on playback start
to issue the PW_MGMT1/PW_MGMT3 dummy writes from a non-atomic context.
The worker dereferences ak4613_priv and accesses the component over I2C.

priv is allocated with devm_kzalloc() and the component driver has no
remove callback, so nothing cancels the work on unbind. If the device is
unbound while the work is still pending, the worker runs after priv has
been freed by devres, resulting in a use-after-free.

Cancel the work from a component remove callback, which runs while priv
and the component are still valid.

Fixes: 03bbf9f5e4eb ("ASoC: ak4613: call dummy write for PW_MGMT1/3 when Playback")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hyunjung Ko <hj351016@xxxxxxxxx>
---
 sound/soc/codecs/ak4613.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sound/soc/codecs/ak4613.c b/sound/soc/codecs/ak4613.c
index 0000000..0000000 100644
--- a/sound/soc/codecs/ak4613.c
+++ b/sound/soc/codecs/ak4613.c
@@ -807,7 +807,15 @@ static int ak4613_resume(struct snd_soc_component *component)
 	return regcache_sync(regmap);
 }

+static void ak4613_remove(struct snd_soc_component *component)
+{
+	struct ak4613_priv *priv = snd_soc_component_get_drvdata(component);
+
+	cancel_work_sync(&priv->dummy_write_work);
+}
+
 static const struct snd_soc_component_driver soc_component_dev_ak4613 = {
+	.remove			= ak4613_remove,
 	.suspend		= ak4613_suspend,
 	.resume			= ak4613_resume,
 	.set_bias_level		= ak4613_set_bias_level,
--
2.43.0