Re: [PATCH 2/2] ASoC: qcom: x1e80100: recreate the headset jack on card rebind

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] ASoC: qcom: x1e80100: missing DP jack cleanup in
  x1e80100_snd_exit()
--

commit f605374e23a64b3505524d6591f1d001a229a2a3
Author: Tyler Baker <tyler.baker@oss.qualcomm.com>

ASoC: qcom: x1e80100: recreate the headset jack on card rebind

This commit adds a DAI link exit callback for x1e80100 to clean up the
headset jack and reset jack_setup on card unbind.

> diff --git a/sound/soc/qcom/x1e80100.c b/sound/soc/qcom/x1e80100.c
> index c81df41ace883..213d7f45198cb 100644
> --- a/sound/soc/qcom/x1e80100.c
> +++ b/sound/soc/qcom/x1e80100.c
> @@ -68,6 +68,23 @@ static int x1e80100_snd_init(struct snd_soc_pcm_runtime *rtd)
>  	return qcom_snd_wcd_jack_setup(rtd, &data->jack, &data->jack_setup);
>  }
>  
> +static void x1e80100_snd_exit(struct snd_soc_pcm_runtime *rtd)
> +{
> +	struct x1e80100_snd_data *data = snd_soc_card_get_drvdata(rtd->card);
> +	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
> +
> +	switch (cpu_dai->id) {
> +	case DISPLAY_PORT_RX_0:
> +	case DISPLAY_PORT_RX_1 ... DISPLAY_PORT_RX_7:
> +		return;
> +	default:
> +		break;
> +	}

[Severity: High]
Does returning early for DisplayPort links leave hdmi_codec_priv->jack
pointing to data->dp_jack[dp_pcm_id] after snd_card_free() frees its
underlying struct snd_jack?

On card rebind, snd_soc_bind_card() runs soc_probe_link_components()
before soc_init_pcm_runtime() calls x1e80100_snd_init() to recreate
dp_jack->jack.  During soc_probe_link_components(), hdmi_probe() calls
drm_connector_hdmi_audio_hook_plugged_cb(), which synchronously invokes
hdmi_codec_jack_report():

sound/soc/codecs/hdmi-codec.c:hdmi_codec_jack_report() {
    ...
	if (jack_status != hcp->jack_status) {
		if (hcp->jack)
			snd_soc_jack_report(hcp->jack, jack_status, SND_JACK_AVOUT);
		hcp->jack_status = jack_status;
	}
}

If the DisplayPort plug state changed while the card was unbound,
snd_soc_jack_report() dereferences the freed dp_jack->jack (use-after-free).
Calling qcom_snd_headset_jack_cleanup(rtd) before returning for the
DisplayPort links clears hcp->jack on unbind.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106054333.2748248-1-tyler.baker@oss.qualcomm.com?part=2