]> git.hungrycats.org Git - linux/commit
ASoC: cs35l56: Prevent double-free of debugfs
authorRichard Fitzgerald <rf@opensource.cirrus.com>
Wed, 10 Jun 2026 09:34:31 +0000 (10:34 +0100)
committerMark Brown <broonie@kernel.org>
Wed, 10 Jun 2026 10:24:45 +0000 (11:24 +0100)
commit344a12ca7ba6e10f9779476780afe9d977d47322
treecb783493041734882cc6ffe01aec7b3edeb39955
parent85f7bf03632bfcdd6cedfb3945b7e387d9487d73
ASoC: cs35l56: Prevent double-free of debugfs

Invalidate the debugfs pointer after debugfs_remove_recursive() in
cs35l56_remove_cal_debugfs(). This prevents a double-free situation when
a future commit adds proper failure cleanup in cs35l56_component_probe().

As described by Sashiko (including the future cs35l56_component_probe()
cleanup commit):

During a normal component unbind, cs35l56_component_remove() calls
cs35l56_remove_cal_debugfs() which removes the directory but leaves
a dangling pointer.

If the component is later bound again, but _cs35l56_component_probe()
fails early (for example, if the init_completion times out), this new
error path will call cs35l56_component_remove(). This causes
cs35l56_remove_cal_debugfs() to be called again with the dangling
cs35l56_base->debugfs pointer from the previous lifecycle, resulting in
a use-after-free in debugfs_remove_recursive().

Fixes: f7097161e94c ("ASoC: cs35l56: Add common code for factory calibration")
Reported-by: sashiko <sashiko@sashiko.dev>
Link: https://sashiko.dev/#/patchset/20260609120738.284770-1-rf%40opensource.cirrus.com
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://patch.msgid.link/20260610093432.557375-3-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
sound/soc/codecs/cs35l56-shared.c