From 282f757159a1b0ba666acc8d511a32c92e9d321e Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 6 Aug 2016 12:55:50 -0400 Subject: ALSA: hda - fix use-after-free after module unload [ Upstream commit ab58d8cc870ef3f0771c197700441936898d1f1d ] register_vga_switcheroo() sets the PM ops from the hda structure which is freed later in azx_free. Make sure that these ops are cleared. Caught by KASAN, initially noticed due to a general protection fault. Fixes: 246efa4a072f ("snd/hda: add runtime suspend/resume on optimus support (v4)") Signed-off-by: Peter Wu Cc: Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin --- sound/pci/hda/hda_intel.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'sound') diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 9e113bc3b02d..6a37c9bdf274 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -1123,8 +1123,10 @@ static int azx_free(struct azx *chip) if (use_vga_switcheroo(hda)) { if (chip->disabled && chip->bus) snd_hda_unlock_devices(chip->bus); - if (hda->vga_switcheroo_registered) + if (hda->vga_switcheroo_registered) { vga_switcheroo_unregister_client(chip->pci); + vga_switcheroo_fini_domain_pm_ops(chip->card->dev); + } } if (chip->initialized) { -- cgit v1.2.3