On Sat, Aug 22, 2026 at 04:32:18PM +0200, Karl Mehltretter wrote: > vc4_hdmi, including the embedded ASoC card, is DRM-managed and freed > together with the DRM device when the aggregate device is torn down. > The card however is registered device-managed on the HDMI platform > device, whose release runs later
Not necessarily, no. The comment you removed explained it. DRM-managed memory isn't removed when the device in unbound/removed, but when it has been and the last fd to the device file has been closed to userspace. > so snd_soc_unregister_card() operates on freed memory: > > # modprobe vc4; rmmod vc4 > BUG: KASAN: slab-use-after-free in snd_soc_unregister_card > Read of size 1 at addr ffff0000456a8450 by task rmmod/262 > Allocated by task 171: drmm_kmalloc / vc4_hdmi_bind > Freed by task 262 (rmmod): drm_managed_release / drm_dev_put And that happens only because you have no user. If you had one, you would have had the opposite sequence. Maxime
signature.asc
Description: PGP signature
