[26.04_linux-nvidia] NVIDIA: SAUCE: ASoC: sdw_utils: clear stale device references in exit hooks - #560
Conversation
kbutala-nv
changed the title
BaseOS Kernel ReviewWarning
|
PR Validation ReportPatchscan ✅ No Missing FixesAll cherry-picked commits checked — no missing upstream fixes found. PR Lint ✅ All checks passedDetailsChecking 2 commits... Cherry-pick digest: ┌──────────────┬──────────────────────────────────────────────────────────────────┬────────────┬─────────┬───────────────────────────┐ │ Local │ Referenced upstream / Patch subject │ Patch-ID │ Subject │ SoB chain │ ├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤ │ 3cb89180e6c1 │ [SAUCE] asoc: sdw_utils: clear stale rt711 device reference │ N/A │ N/A │ dcemin, kbutala │ ├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤ │ 97623639ef94 │ 046173b98de3 ASoC: sdw_utils: fix double put_device() on aggrega │ match │ match │ preserved + kbutala added │ └──────────────┴──────────────────────────────────────────────────────────────────┴────────────┴─────────┴───────────────────────────┘ Lint: all checks passed. |
|
@kbutala-nv Can you please cherry-pick https://lore.kernel.org/all/20260818023018.2564212-1-jack.yu@realtek.com/ and add a new patch for the remaining one. |
Agreed. And please target the PR to |
|
@kbutala-nv Could you please add this Launchpad bug to the both PR description? |
In aggregation mode with two identical amplifiers, a stress test that repeatedly triggers card unbind/rebind can hit a NULL pointer dereference during the exit path. ctx->amp_dev1 / ctx->amp_dev2 are single shared resources, so the release must be safe against being called more than once. Clear each pointer after put_device() so a second invocation becomes a no-op, this could address NULL pointer dereference issue. Signed-off-by: Jack Yu <jack.yu@realtek.com> Link: https://patch.msgid.link/20260818023018.2564212-1-jack.yu@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org> (cherry picked from commit 046173b) Signed-off-by: Kaushal Rajeev Butala <kbutala@nvidia.com>
asoc_sdw_rt711_exit() drops the reference held in ctx->headset_codec_dev, but leaves the pointer populated. If the card cleanup path reaches the exit hook more than once after a failed or deferred probe, a later invocation can reuse the stale pointer and call put_device() again. Clear the pointer after put_device() so repeated cleanup becomes a no-op. This avoids refcount underflow and possible oopses when later probe, driver bind, or suspend paths walk the SoundWire bus after the device reference was released. This is similar to upstream fix 046173b Signed-off-by: David Cemin <dcemin@nvidia.com> Signed-off-by: Kaushal Rajeev Butala <kbutala@nvidia.com>
089fb30 to
3cb8918
Compare
Done |
Done! |
@kbutala-nv: Does this one need to be SAUCE? It seems like upstream would benefit as well -- if you agree, I think it'd be best to send that to LKML and then add a |
|
Done |
|
It seems like upstream would benefit as well -- if you agree, I think it'd be best to send that to LKML and then add a (backported from ) line to the trailer.
|
In my opinion, it would be preferable to at least have that reference -- the patch doesn't even have to be accepted, simply sending it makes a difference in our ability to track things later. |
@kbutala-nv I share this same opinion and would prefer posting to LKML before we take this as SAUCE. |
4 participants
asoc_sdw_rt_amp_exit() drops the references held in ctx->amp_dev1 and ctx->amp_dev2, but leaves the pointers populated. If the card cleanup path runs the exit hook more than once, the same device references are dropped again, which can underflow the device refcount and leave stale pointers for later SoundWire bus walks.
In practice this can show up as refcount underflow warnings followed by an oops when later probe, driver bind, or suspend paths walk the SoundWire bus and touch the freed device.
This first part is fixed upstream via change 046173b
Clear the amplifier device pointers after put_device(), matching the idempotent pattern already used by the RT SDCA jack cleanup path. Do the same for the RT711 headset codec device pointer.
This second part is covered through second patch under this PR.
This makes the exit hooks safe to call after deferred or failed card probe paths and avoids stale device references being reused after cleanup.
This is tracked in internal bug 6290103
LP: https://bugs.launchpad.net/ubuntu/+source/linux-nvidia/+bug/2166188