Thanks for the review. You're right, I'll send a v2 that also disables the SDCA IRQs in the component remove path to close the TOCTOU window, keeping the NULL guard as defense-in-depth.


________________________________________
From: Mark Brown
Sent: Wednesday, March 11, 2026 9:31 AM
To: Tsai, Gaggery
Cc: linux-sound@vger.kernel.org; patches@opensource.cirrus.com; ckeepax@opensource.cirrus.com; mstrozek@opensource.cirrus.com; yung-chuan.liao@linux.intel.com; pierre-louis.bossart@linux.dev; stable@vger.kernel.org
Subject: Re: [PATCH] ASoC: SDCA: Fix NULL pointer dereference in sdca_jack_process()


On Tue, Mar 10, 2026 at 11:38:29AM -0700, gaggery.tsai@intel.com wrote:

sdca_jack_process() unconditionally dereferences component->card and

card->snd_card at the top of the function. This causes a NULL pointer

dereference when the SDCA IRQ handler fires after the ASoC card has

been torn down.

+     if (!card || !card->snd_card) {

+             dev_dbg(dev, "card not yet bound, deferring jack event\n");

+             return -ENODEV;

+     }

+

+     rwsem = &card->snd_card->controls_rwsem;

+     kctl = state->kctl;

+

Don't we still have a time of check/time of use issue here while the

card is being removed - do we do something to stop interrupts being

delivered after the card is unbound?