Re: [PATCH 03/12] ASoC: codecs: wm8994: Implement set_jack callback

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] ASoC: wm8994: stale jack pointer and active work in wm8958_mic_detect()
--

commit 0dc23f1f04114660da148a373855c1151a4983df
Author: Amadeusz Sławiński <amade@asmblr.net>

ASoC: codecs: wm8994: Implement set_jack callback

This commit implements the set_jack callback for the wm8994 component driver,
delegating to wm8994_mic_detect() for WM8994 and wm8958_mic_detect() for
WM1811 and WM8958 so machine drivers can use snd_soc_component_set_jack().

> diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
> index 6b91e02f130b3..69afba1764eb7 100644
> --- a/sound/soc/codecs/wm8994.c
> +++ b/sound/soc/codecs/wm8994.c
> @@ -4642,12 +4642,30 @@ static void wm8994_component_remove(struct snd_soc_component *component)
>  	kfree(wm8994->retune_mobile_texts);
>  }
>  
> +static int wm8994_set_jack(struct snd_soc_component *component,
> +			   struct snd_soc_jack *jack, void *data)
> +{
> +	struct wm8994_priv *wm8994 = snd_soc_component_get_drvdata(component);
> +	struct wm8994 *control = wm8994->wm8994;
> +
> +	switch (control->type) {
> +	case WM8994:
> +		return wm8994_mic_detect(component, jack, data ? *(int *)data : 1);
> +	case WM1811:
> +	case WM8958:
> +		return wm8958_mic_detect(component, jack, NULL, NULL, NULL, NULL);

[Severity: High]
When snd_soc_component_set_jack(component, NULL, NULL) is called during jack
teardown or card unbind on WM1811 or WM8958, wm8994_set_jack() passes a NULL
jack pointer to wm8958_mic_detect().

In sound/soc/codecs/wm8994.c, the NULL jack branch of wm8958_mic_detect()
does not clear wm8994->micdet[0].jack or cancel pending delayed work:

	} else {
		snd_soc_component_update_bits(component, WM8958_MIC_DETECT_1,
				    WM8958_MICD_ENA, 0);
		wm1811_jackdet_set_mode(component, WM1811_JACKDET_MODE_NONE);
		snd_soc_dapm_disable_pin(dapm, "CLK_SYS");
		snd_soc_dapm_sync(dapm);
	}

Because wm8994->micdet[0].jack remains non-NULL, wm1811_jackdet_set_mode()
still treats jack detection as active:

	if (!wm8994->jackdet || !wm8994->micdet[0].jack)
		return;

	if (wm8994->active_refcount)
		mode = WM1811_JACKDET_MODE_AUDIO;

If wm8994->active_refcount is non-zero during teardown,
wm1811_jackdet_set_mode() overrides WM1811_JACKDET_MODE_NONE with
WM1811_JACKDET_MODE_AUDIO, and subsequent active_dereference() calls re-arm
hardware jack or microphone detection.

In addition, pending delayed work items such as wm8958_open_circuit_work,
wm1811_jackdet_bootstrap, wm1811_mic_work, and wm8958_mic_work are not
canceled and can still dereference the stale wm8994->micdet[0].jack pointer:

	snd_soc_jack_report(wm8994->micdet[0].jack, 0,
			    wm8994->btn_mask |
			    SND_JACK_HEADSET);

Can this leave a dangling jack pointer and cause a use-after-free in
snd_soc_jack_report() after the jack is freed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026201915.57184-1-amade@asmblr.net?part=3