Two AMD machine drivers treat a borrowed ACPI physical device pointer as an
owned reference. The ES8336 driver drops it on a GPIO lookup failure; the
ACP3x driver drops it on an allocation failure and also stores it beyond
probe. Both paths produced a KASAN use-after-free during device unregister
in focused tests calling the production callbacks. The corresponding fixed
tests reached the same failure paths without a kernel diagnostic.

The tests did not exercise a complete sound card or physical hardware.

Changes since v1:
  - Include <acpi/acpi_bus.h> directly in patch 2 so the primary-device
    helper is declared when CONFIG_ACPI=n, as Mark Brown pointed out.
  - Patch 1 is unchanged.

The changed ACP3x object builds with W=1 with CONFIG_ACPI=y and
CONFIG_ACPI=n. The ES8336 object builds with W=1 with CONFIG_ACPI=y.

Yibo Tan (2):
  ASoC: amd: acp-es8336: Use an owned codec device reference
  ASoC: amd: acp3x-es83xx: Keep an owned codec device reference

 sound/soc/amd/acp-es8336.c                    |  5 ++---
 sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c | 14 +++++++++++++-
 2 files changed, 15 insertions(+), 4 deletions(-)


base-commit: 0ed6f7f62318a581fe9698f8a4e98c7ca01160e4
-- 
2.39.5