vc4_hdmi, including the embedded ASoC card, is DRM-managed and freed
with the DRM device when the aggregate device is torn down. The card is
registered with devm_snd_soc_register_card() on the HDMI platform device
from the component bind callback, so its devres node starts out in the
component's devres group and used to be released at component unbind,
while vc4_hdmi is still alive.
Whenever an ASoC component is registered, the core retries every card
waiting for components. For a devm-managed card, each retry destroys and
re-adds its devres node. Because snd_soc_bind_card() requeues the card and
converts -EPROBE_DEFER to success, even a retry that still defers can move
the node outside the now-closed component devres group. It is then only
released at platform driver detach, after vc4_hdmi has been freed:
# modprobe vc4; rmmod vc4
BUG: KASAN: slab-use-after-free in snd_soc_unregister_card
Read of size 1 at addr ffff0000456a8450 by task rmmod/262
devm_card_bind_release / devres_release_all / driver_detach
Allocated by task 171: drmm_kmalloc / vc4_hdmi_bind
Freed by task 262 (rmmod): drm_dev_put / component_del
Register the card without devm and unregister it from a component unbind
callback, where the HDMI device resources and the DRM-managed structure
are both still alive, regardless of where the card got bound.
Fixes: 42d99857d6f0 ("ASoC: core: Move all users to deferrable card binding")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <[email protected]>
---
v2:
- Preserve the existing ASoC component-lifetime comment and document at
the card registration site how deferrable binding can move the card's
devres node outside the component devres group.
- Point Fixes at the deferrable card binding change.
- Add the ASoC maintainers and linux-sound recipients, add the stable
trailer, and update Assisted-by to the current format.
Tested on a Raspberry Pi 400 (BCM2711), v7.2-11658-g26260251022f, with
KASAN: report gone, rmmod/insmod loop clean.
drivers/gpu/drm/vc4/vc4_hdmi.c | 24 +++++++++++++++++++++---
drivers/gpu/drm/vc4/vc4_hdmi.h | 1 +
2 files changed, 22 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 17c8635c5afa..7e312932488a 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -2422,12 +2422,18 @@ static int vc4_hdmi_audio_init(struct vc4_hdmi
*vc4_hdmi)
* snd_soc_card_get_drvdata() if needed.
*/
snd_soc_card_set_drvdata(card, vc4_hdmi);
- ret = devm_snd_soc_register_card(dev, card);
+
+ /*
+ * Deferred card binding can move a devm registration outside the
+ * component devres group, so unregister the card explicitly at unbind.
+ */
+ ret = snd_soc_register_card(card);
if (ret)
- dev_err_probe(dev, ret, "Could not register sound card\n");
+ return dev_err_probe(dev, ret, "Could not register sound
card\n");
- return ret;
+ vc4_hdmi->audio.card_registered = true;
+ return 0;
}
static irqreturn_t vc4_hdmi_hpd_irq_thread(int irq, void *priv)
@@ -3345,8 +3351,20 @@ err_put_runtime_pm:
return ret;
}
+static void vc4_hdmi_unbind(struct device *dev, struct device *master,
+ void *data)
+{
+ struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
+
+ if (vc4_hdmi->audio.card_registered) {
+ snd_soc_unregister_card(&vc4_hdmi->audio.card);
+ vc4_hdmi->audio.card_registered = false;
+ }
+}
+
static const struct component_ops vc4_hdmi_ops = {
.bind = vc4_hdmi_bind,
+ .unbind = vc4_hdmi_unbind,
};
static int vc4_hdmi_dev_probe(struct platform_device *pdev)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.h b/drivers/gpu/drm/vc4/vc4_hdmi.h
index 29d461d4ee49..444c73513d86 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.h
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.h
@@ -106,6 +106,7 @@ struct vc4_hdmi_audio {
struct snd_soc_dai_link_component platform;
struct snd_dmaengine_dai_dma_data dma_data;
bool streaming;
+ bool card_registered;
};
/* General HDMI hardware state. */
--
2.39.5 (Apple Git-154)
