From mboxrd@z Thu Jan 1 00:00:00 1970 From: Takashi Iwai Subject: Re: [PATCH] snd/hda: fix use-after-free after module unload Date: Mon, 11 Jul 2016 12:42:27 +0200 Message-ID: References: <20160709143857.12044-1-peter@lekensteyn.nl> Mime-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) by alsa0.perex.cz (Postfix) with ESMTP id AB910265558 for ; Mon, 11 Jul 2016 12:42:27 +0200 (CEST) In-Reply-To: <20160709143857.12044-1-peter@lekensteyn.nl> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org To: Peter Wu Cc: alsa-devel@alsa-project.org List-Id: alsa-devel@alsa-project.org On Sat, 09 Jul 2016 16:38:57 +0200, Peter Wu wrote: > > register_vga_switcheroo() sets the PM ops from the hda structure which > is freed later in azx_free. Make sure that these ops are cleared. > > Caught by KASAN. > > Fixes: 246efa4a072f ("snd/hda: add runtime suspend/resume on optimus support (v4)") > Signed-off-by: Peter Wu > --- > sound/pci/hda/hda_intel.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c > index 94089fc..a339066 100644 > --- a/sound/pci/hda/hda_intel.c > +++ b/sound/pci/hda/hda_intel.c > @@ -1219,6 +1219,7 @@ static int azx_free(struct azx *chip) > snd_hda_unlock_devices(&chip->bus); > if (hda->vga_switcheroo_registered) > vga_switcheroo_unregister_client(chip->pci); > + vga_switcheroo_fini_domain_pm_ops(chip->card->dev); The domain pm ops is set only when hda->vga_switcheroo_registered flag is set. So the call should be in the previous if block. Also, the indentation looks wrong. Please use the correct indentation. Could you resubmit with these fixes? thanks, Takashi