[26.04_linux-nvidia-bos] NVIDIA: SAUCE: ASoC: sdw_utils: clear stale device references in exit hooks - #561
Open
kbutala-nv wants to merge 2 commits into
Conversation
In aggregation mode with two identical amplifiers, a stress test that repeatedly triggers card unbind/rebind can hit a NULL pointer dereference during the exit path. ctx->amp_dev1 / ctx->amp_dev2 are single shared resources, so the release must be safe against being called more than once. Clear each pointer after put_device() so a second invocation becomes a no-op, this could address NULL pointer dereference issue. Signed-off-by: Jack Yu <jack.yu@realtek.com> Link: https://patch.msgid.link/20260818023018.2564212-1-jack.yu@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org> (cherry picked from commit 046173b) Signed-off-by: Kaushal Rajeev Butala <kbutala@nvidia.com>
asoc_sdw_rt711_exit() drops the reference held in ctx->headset_codec_dev, but leaves the pointer populated. If the card cleanup path reaches the exit hook more than once after a failed or deferred probe, a later invocation can reuse the stale pointer and call put_device() again. Clear the pointer after put_device() so repeated cleanup becomes a no-op. This avoids refcount underflow and possible oopses when later probe, driver bind, or suspend paths walk the SoundWire bus after the device reference was released. This is similar to commit 046173b ("ASoC: sdw_utils: fix double put_device() on aggregated amps"). Signed-off-by: David Cemin <dcemin@nvidia.com> Signed-off-by: Kaushal Rajeev Butala <kbutala@nvidia.com>
Collaborator
BaseOS Kernel ReviewTip ✅ Review passedNo issues found across the reviewed commits. Findings: none 🔍 Review artifacts
📦 Kernel deb builds — 🟢 2/2 passed
Note Build reports and debs are retained for 10 days after the PR closes. Review metadata
This comment is maintained by BaseOS Reviewer and updated when the GitHub watcher publishes a newer review. |
Contributor
PR Validation ReportPatchscan ✅ No Missing FixesAll cherry-picked commits checked — no missing upstream fixes found. PR Lint ✅ All checks passedDetailsChecking 2 commits... Cherry-pick digest: ┌──────────────┬──────────────────────────────────────────────────────────────────┬────────────┬─────────┬───────────────────────────┐ │ Local │ Referenced upstream / Patch subject │ Patch-ID │ Subject │ SoB chain │ ├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤ │ 1f771f576872 │ [SAUCE] asoc: sdw_utils: clear stale rt711 device reference │ N/A │ N/A │ dcemin, kbutala │ ├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤ │ 1d40c94d9852 │ 046173b98de3 ASoC: sdw_utils: fix double put_device() on aggrega │ match │ match │ preserved + kbutala added │ └──────────────┴──────────────────────────────────────────────────────────────────┴────────────┴─────────┴───────────────────────────┘ Lint: all checks passed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
asoc_sdw_rt_amp_exit() drops the references held in ctx->amp_dev1 and ctx->amp_dev2, but leaves the pointers populated. If the card cleanup path runs the exit hook more than once, the same device references are dropped again, which can underflow the device refcount and leave stale pointers for later SoundWire bus walks.
In practice this can show up as refcount underflow warnings followed by an oops when later probe, driver bind, or suspend paths walk the SoundWire bus and touch the freed device.
This first part is fixed upstream via change 046173b
Clear the amplifier device pointers after put_device(), matching the idempotent pattern already used by the RT SDCA jack cleanup path. Do the same for the RT711 headset codec device pointer.
This second part is covered through second patch under this PR.
This makes the exit hooks safe to call after deferred or failed card probe paths and avoids stale device references being reused after cleanup.
This is tracked in internal bug 6290103
LP: https://bugs.launchpad.net/ubuntu/+source/linux-nvidia/+bug/2166188