Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Incorrect devres device used for component and PCM registration causing use-after-free on driver unbind. -- commit d20d30b72e20d6e45546f7cb8a33e56c5ed791b9 Author: Tomi Valkeinen <[email protected]> ASoC: ti: omap-hdmi: Fix build error from a merge commit This commit removes an invalid assignment to a deleted member 'card' in the hdmi_audio_data structure to fix a build error caused by an incorrect merge. Closes: https://lore.kernel.org/all/[email protected]/ > diff --git a/sound/soc/ti/omap-hdmi.c b/sound/soc/ti/omap-hdmi.c > index c32ec7c0b0cf5..2cabd4cc5b0bd 100644 > --- a/sound/soc/ti/omap-hdmi.c > +++ b/sound/soc/ti/omap-hdmi.c > @@ -405,7 +405,6 @@ static int omap_hdmi_audio_probe(struct platform_device > *pdev) > card->dev = dev; > > atomic_set(&ad->jack_state, -1); > - ad->card = card; [Severity: High] This isn't a bug introduced by this patch, but earlier in this function, component and PCM devres registration are attached to the parent device (ad->dssdev) instead of the child platform device (dev): ret = devm_snd_soc_register_component(ad->dssdev, &omap_hdmi_component, dai_drv, 1); ... ret = sdma_pcm_platform_register(ad->dssdev, "audio_tx", NULL); Could this cause a use-after-free on child driver unbind? If the omap-hdmi-audio driver is manually unbound via sysfs or its module is unloaded, the child device's devres hooks execute and memory allocated for the child (including the hdmi_audio_data struct ad) is freed. Because devm_snd_soc_register_component() and sdma_pcm_platform_register() were called using the parent device (ad->dssdev), their devres cleanup hooks remain attached to the parent and do not execute during child unbind. Does this leave the ASoC core with dangling pointers to the unloaded module's static component structures and freed data? > > snd_soc_card_set_drvdata(card, ad); > ret = devm_snd_soc_register_card(dev, card); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
