Re: [PATCH] ASoC: rt5668: cancel jack detect work on removal to avoid use-after-free

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] ASoC: rt5668: unbalanced disable_irq() in
  rt5668_i2c_shutdown()
--

commit 7ffec355074a97397bd6323b0aff3802254c40bf
Author: Hyunjung Ko <hj351016@gmail.com>

ASoC: rt5668: cancel jack detect work on removal to avoid use-after-free

This commit disables the jack IRQ and cancels the jack detection delayed
works in rt5668_i2c_shutdown(), and hooks that path into a new i2c
.remove callback.

> diff --git a/sound/soc/codecs/rt5668.c b/sound/soc/codecs/rt5668.c
> index 29d70802a046a..c56bbe3fc7bea 100644
> --- a/sound/soc/codecs/rt5668.c
> +++ b/sound/soc/codecs/rt5668.c
> @@ -2584,9 +2584,19 @@ static void rt5668_i2c_shutdown(struct i2c_client *client)
>  {
>  	struct rt5668_priv *rt5668 = i2c_get_clientdata(client);
>  
> +	if (client->irq)
> +		disable_irq(client->irq);
> +	cancel_delayed_work_sync(&rt5668->jack_detect_work);
> +	cancel_delayed_work_sync(&rt5668->jd_check_work);
> +
>  	rt5668_reset(rt5668->regmap);
>  }
>  
> +static void rt5668_i2c_remove(struct i2c_client *client)
> +{
> +	rt5668_i2c_shutdown(client);
> +}

[Severity: Medium]
Does calling disable_irq(client->irq) unconditionally here conflict with
965bad6195d0 ("ASoC: rt5668: cancel delayed works on component removal")?

That commit updated the component remove callback rt5668_remove() to track
IRQ ownership and state via rt5668->irq_acquired and rt5668->irq_disabled,
cancel both delayed works, and reset the codec:

sound/soc/codecs/rt5668.c:rt5668_remove() {
	struct rt5668_priv *rt5668 = snd_soc_component_get_drvdata(component);
	struct i2c_client *i2c = to_i2c_client(component->dev);

	if (rt5668->irq_acquired) {
		disable_irq(i2c->irq);
		rt5668->irq_disabled = true;
	}

	cancel_delayed_work_sync(&rt5668->jack_detect_work);
	cancel_delayed_work_sync(&rt5668->jd_check_work);

	rt5668_reset(rt5668->regmap);
}

During i2c driver unbind, rt5668_i2c_remove() runs before devres
unregisters the component, so it resets the chip while the sound card is
still bound and then rt5668_remove() runs and calls disable_irq() and
rt5668_reset() a second time. In addition, rt5668_i2c_probe() continues if
devm_request_threaded_irq() fails, leaving client->irq non-zero with
rt5668->irq_acquired false, so unbind or shutdown disables an IRQ line the
driver never acquired.

The commit message also says that the component .remove callback only
resets the chip and neither disables the IRQ nor cancels the delayed work,
which is no longer true after 965bad6195d0 ("ASoC: rt5668: cancel delayed
works on component removal").

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109172134.1850973-1-hj351016@gmail.com?part=1