Re: [PATCH] ALSA: hda: intel: Don't free card in the probe work

[Takashi Iwai <tiwai@suse.de>]

On Mon, 12 Oct 2026 17:09:41 +0200,
Ali Ahmet Memiş wrote:
> 
> On Mon, 12 Oct 2026 16:57:37 +0200, Takashi Iwai wrote:
> > OK, that's a problem, indeed.  How about replacing snd_card_free()
> > with *_when_closed() version that doesn't block in addition?
> 
> The work doesn't hang anymore but removing the device while the probe
> work is running hits the same UAF on the first try.  azx_remove() still
> gets the card before cancel_delayed_work_sync() and the put_device() in
> the work frees it:
> 
> BUG: KASAN: slab-use-after-free in snd_card_free+0x148/0x160
> Read of size 1 at addr ffff888007724852 by task sh/97
> Call Trace:
>  snd_card_free+0x148/0x160
>  pci_device_remove+0xb6/0x1d0
>  device_release_driver_internal+0x38d/0x540
>  pci_stop_bus_device+0x122/0x170
>  ...
> Freed by task 30:
>  kfree+0x1e8/0x5e0
>  device_release+0xcf/0x3c0
>  kobject_put+0x169/0x320
>  azx_probe_work+0x495/0x1fa0
>  process_one_work+0x937/0x1800
> 
> > Staying the card means that the card slot will be kept, then if you
> > probe another card afterwards, it'll end up with assignment on another
> > card slot.
> 
> What about calling snd_card_disconnect() in the work on failure?  It
> releases the slot right away and the card is still freed only in
> azx_remove():
> 
> 	if (azx_probe_continue(&hda->chip, false) < 0) {
> 		hda->init_failed = 1;
> 		complete_all(&hda->probe_wait);
> 		snd_card_disconnect(hda->chip.card);
> 	}
> 
> With that, snd-dummy loaded after a failed probe gets card 0 and 20
> rounds of the remove race were clean with KASAN.  I can send v2 if this
> looks fine.

Yeah, that sounds like a plan.
Care to resubmit a fix with that approach?


thanks,

Takashi