[PATCH] ASoC: sdw_utils: clear stale RT711 device reference on exit

[PATCH] ASoC: sdw_utils: clear stale RT711 device reference on exit

[David Cemin]

asoc_sdw_rt711_exit() drops the reference held in ctx->headset_codec_dev
but leaves the pointer populated. If the card cleanup path reaches the
exit hook more than once after a failed or deferred probe, a later
invocation reuses the stale pointer and calls put_device() again,
underflowing the refcount and leading to oopses when later probe,
driver bind, or suspend paths walk the SoundWire bus after the device
reference was released. Observed as boot- and suspend-time oopses on an
arm64 platform with an RT712 headset codec, reproducible
deterministically by repeated machine-driver probe cycling with the
codec drivers unloaded.

Clear the pointer after put_device() so repeated cleanup becomes a
no-op, which also makes the existing NULL check at the top of the exit
hook effective. This matches what commit 046173b98de3 ("ASoC: sdw_utils:
fix double put_device() on aggregated amps") did for the aggregated amp
references.

Fixes: 811648340707 ("ASoC: Intel: sof_sdw: avoid oops in error handling")
Cc: stable@vger.kernel.org
Signed-off-by: David Cemin <dcemin@nvidia.com>
---
 sound/soc/sdw_utils/soc_sdw_rt711.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/sdw_utils/soc_sdw_rt711.c b/sound/soc/sdw_utils/soc_sdw_rt711.c
index 3a3a66b4b737..4707190e160c 100644
--- a/sound/soc/sdw_utils/soc_sdw_rt711.c
+++ b/sound/soc/sdw_utils/soc_sdw_rt711.c
@@ -124,6 +124,7 @@ int asoc_sdw_rt711_exit(struct snd_soc_card *card, struct snd_soc_dai_link *dai_
 
 	device_remove_software_node(ctx->headset_codec_dev);
 	put_device(ctx->headset_codec_dev);
+	ctx->headset_codec_dev = NULL;
 
 	return 0;
 }

base-commit: 841e384b841a3d89c50b4b2d6c5bb6abab1a7e39
-- 
2.55.0

Re: [PATCH] ASoC: sdw_utils: clear stale RT711 device reference on exit

[Pierre-Louis Bossart]

On 9/12/26 20:21, David Cemin wrote:
> asoc_sdw_rt711_exit() drops the reference held in ctx->headset_codec_dev
> but leaves the pointer populated. If the card cleanup path reaches the
> exit hook more than once after a failed or deferred probe, a later
> invocation reuses the stale pointer and calls put_device() again,
> underflowing the refcount and leading to oopses when later probe,
> driver bind, or suspend paths walk the SoundWire bus after the device
> reference was released. Observed as boot- and suspend-time oopses on an
> arm64 platform with an RT712 headset codec, reproducible
> deterministically by repeated machine-driver probe cycling with the
> codec drivers unloaded.
> 
> Clear the pointer after put_device() so repeated cleanup becomes a
> no-op, which also makes the existing NULL check at the top of the exit
> hook effective. This matches what commit 046173b98de3 ("ASoC: sdw_utils:
> fix double put_device() on aggregated amps") did for the aggregated amp
> references.
> 
> Fixes: 811648340707 ("ASoC: Intel: sof_sdw: avoid oops in error handling")
> Cc: stable@vger.kernel.org
> Signed-off-by: David Cemin <dcemin@nvidia.com>
> ---
>  sound/soc/sdw_utils/soc_sdw_rt711.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/sound/soc/sdw_utils/soc_sdw_rt711.c b/sound/soc/sdw_utils/soc_sdw_rt711.c
> index 3a3a66b4b737..4707190e160c 100644
> --- a/sound/soc/sdw_utils/soc_sdw_rt711.c
> +++ b/sound/soc/sdw_utils/soc_sdw_rt711.c
> @@ -124,6 +124,7 @@ int asoc_sdw_rt711_exit(struct snd_soc_card *card, struct snd_soc_dai_link *dai_
>  
>  	device_remove_software_node(ctx->headset_codec_dev);
>  	put_device(ctx->headset_codec_dev);
> +	ctx->headset_codec_dev = NULL;
>  
>  	return 0;
>  }
The analysis looks correct, the only problem is that this code pattern
is copy-pasted with the same issue in other files, e.g.

int asoc_sdw_es9356_exit(struct snd_soc_card *card, struct
snd_soc_dai_link *dai_link)
{
	struct asoc_sdw_mc_private *ctx = snd_soc_card_get_drvdata(card);

	if (!ctx->headset_codec_dev)
		return 0;

	device_remove_software_node(ctx->headset_codec_dev);
	put_device(ctx->headset_codec_dev);


It'd be best to use a common helper and fix this across the board, no?