[BUG] Initializing the SoundWire driver sometimes causes a kernel OOPS

[EricLin0509]

Bug Summary

The SoundWire driver will cause use-after-free bug when initializing the hardware (especially during the cold boot with the speaker mute) according to the journal log

[    8.993831] ------------[ cut here ]------------
[    8.993834] refcount_t: addition on 0; use-after-free.
[    8.993836] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x52/0xa0, CPU#6: kworker/u66:8/859
[    8.993845] Modules linked in: intel_ishtp_hid snd_soc_sof_sdw snd_sof_probes snd_soc_intel_hda_dsp_common snd_soc_rt1320_sdw(+) snd_soc_rt712_sdca(+) snd_hda_codec_intelhdmi regmap_sdw_mbq snd_hda_codec_hdmi snd_soc_dmic regmap_sdw snd_hda_intel snd_sof_pci_intel_ptl snd_sof_pci_intel_lnl snd_sof_pci_intel_mtl snd_sof_intel_hda_generic soundwire_intel soundwire_cadence snd_sof_intel_hda_sdw_bpt snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda snd_sof_intel_hda_mlink snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_hda_ext_core snd_hda_codec intel_rapl_msr snd_hda_core intel_uncore_frequency intel_uncore_frequency_common snd_soc_acpi_intel_match intel_tcc_cooling snd_soc_acpi_intel_sdca_quirks x86_pkg_temp_thermal snd_intel_dspcfg joydev intel_powerclamp mousedev snd_intel_sdw_acpi coretemp soundwire_generic_allocation xe snd_soc_sdw_utils f2fs snd_soc_acpi snd_hwdep vfat lz4hc_compress soundwire_bus fat lz4_compress kvm_intel iwlmld snd_soc_sdca drm_gpusvm_helper uvcvideo gpu_sched snd_soc_core
[    8.993885]  mac80211 drm_gpuvm uvc processor_thermal_device_pci kvm drm_buddy videobuf2_vmalloc ucsi_acpi iTCO_wdt ac97_bus videobuf2_memops processor_thermal_device hid_sensor_prox drm_suballoc_helper snd_pcm_dmaengine typec_ucsi spi_nor intel_pmc_bxt videobuf2_v4l2 snd_compress processor_thermal_power_floor hid_sensor_trigger drm_exec roles snd_pcm ptp kfifo_buf processor_thermal_wt_hint i2c_algo_bit mtd typec hid_multitouch irqbypass pps_core hid_sensor_iio_common i2c_i801 videobuf2_common processor_thermal_wt_req snd_timer drm_ttm_helper industrialio msi_wmi_platform mei_gsc_proxy wmi_bmof msi_wmi libarc4 intel_cstate snd videodev processor_thermal_rfim ttm i2c_smbus btintel_pcie iwlwifi i2c_hid_acpi spi_intel_pci processor_thermal_mbox soundcore dptf_power intel_pmc_core btintel int3403_thermal hid_sensor_hub mc intel_uncore drm_display_helper platform_temperature_control pcspkr spi_intel i2c_mux crc8 i2c_hid soc_button_array pmt_telemetry acpi_tad int3400_thermal intel_hid cfg80211 processor_thermal_rapl cec
[    8.993930]  bluetooth acpi_thermal_rel pmt_discovery pinctrl_intel_platform sparse_keymap intel_rapl_common video mei_me acpi_pad pmt_class intel_ish_ipc processor_thermal_soc_slider intel_pmc_ssram_telemetry intel_vpu thunderbolt wmi mei rfkill intel_ishtp int340x_thermal_zone igen6_edac intel_vsec serio_raw mac_hid sch_fq_codel dm_crypt encrypted_keys trusted tee asn1_encoder nvme aesni_intel gf128mul nvme_core aead nvme_keyring intel_lpss_pci intel_lpss nvme_auth idma64 msi_ec dm_mod i2c_dev ec_sys crypto_user pkcs8_key_parser
[    8.993958] CPU: 6 UID: 0 PID: 859 Comm: kworker/u66:8 Not tainted 7.1.6-1-cachyos #1 PREEMPT(full)  132541e3de5d2f5f11d6a70aed24f72078b46b62
[    8.993963] Hardware name: Micro-Star International Co., Ltd. Prestige 16 Flip AI+ C3MTG/MS-2622, BIOS E2622IMS.119 07/07/2026
[    8.993965] Workqueue: events_unbound deferred_probe_work_func
[    8.993973] RIP: 0010:refcount_warn_saturate+0x52/0xa0
[    8.993978] Code: b9 3a c3 cc cc cc cc cc 85 f6 74 3b 83 fe 01 75 48 48 8d 3d 80 a0 eb 01 67 48 0f b9 3a c3 cc cc cc cc cc 48 8d 3d 7e a0 eb 01 <67> 48 0f b9 3a c3 cc cc cc cc cc 48 8d 3d 7c a0 eb 01 67 48 0f b9
[    8.993980] RSP: 0018:ffffce1b00c03a48 EFLAGS: 00010046
[    8.993984] RAX: 0000000000000000 RBX: ffffce1b00c03a88 RCX: 0000000000000000
[    8.993986] RDX: 0000000000000033 RSI: 0000000000000002 RDI: ffffffffaaefe420
[    8.993988] RBP: ffff8d1a5bcb2168 R08: 0000000000000001 R09: 0000000000000001
[    8.993990] R10: 0000000000000000 R11: ffffffffa938bfb0 R12: 0000000000000246
[    8.993992] R13: ffff8d1a5bcb2180 R14: ffff8d1a5bcb2068 R15: 0000000000000000
[    8.993993] FS:  0000000000000000(0000) GS:ffff8d21f3df5000(0000) knlGS:0000000000000000
[    8.993996] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.993998] CR2: 00007a936a375650 CR3: 0000000499c12003 CR4: 0000000108f72ef0
[    8.994001] PKRU: 55555554
[    8.994002] Call Trace:
[    8.994004]  <TASK>
[    8.994006]  klist_next+0xcc/0xd0
[    8.994011]  ? __pfx_device_match_name+0x10/0x10
[    8.994017]  bus_find_device+0xf8/0x170
[    8.994022]  asoc_sdw_parse_sdw_endpoints+0x530/0xc20 [snd_soc_sdw_utils 9e050c2bac5be59a8cfe098be9ac07f824995b5d]
[    8.994040]  mc_probe+0x3e3/0x1240 [snd_soc_sof_sdw b803e61946d9f78cff15a32946ae7a8a6a45a2da]
[    8.994045]  ? kernfs_activate_one+0x29/0x70
[    8.994050]  ? kernfs_activate+0x4e/0x140
[    8.994054]  ? kernfs_add_one+0x11c/0x160
[    8.994058]  platform_probe.llvm.2160526394616576682+0x43/0x80
[    8.994063]  really_probe+0x1bc/0x4b0
[    8.994068]  __driver_probe_device+0xa1/0x140
[    8.994073]  driver_probe_device+0x1e/0x110
[    8.994077]  __device_attach_driver+0xc1/0x150
[    8.994082]  ? __pfx___device_attach_driver+0x10/0x10
[    8.994086]  bus_for_each_drv+0x12a/0x180
[    8.994090]  __device_attach.llvm.5232205908058392405+0xd3/0x1c0
[    8.994095]  device_initial_probe+0x34/0x50
[    8.994099]  bus_probe_device+0xa2/0x120
[    8.994102]  deferred_probe_work_func+0x9d/0x100
[    8.994106]  process_scheduled_works+0x1ea/0x450
[    8.994111]  worker_thread+0x339/0x570
[    8.994116]  ? __pfx_worker_thread+0x10/0x10
[    8.994121]  kthread+0xfb/0x120
[    8.994124]  ? __pfx_kthread+0x10/0x10
[    8.994127]  ret_from_fork+0xee/0x260
[    8.994131]  ? __pfx_kthread+0x10/0x10
[    8.994133]  ret_from_fork_asm+0x1a/0x30
[    8.994140]  </TASK>
[    8.994141] ---[ end trace 0000000000000000 ]---

Full dmesg log: dmesg.txt

I'm not sure this issue by the SoundWire driver. I found asoc_sdw_rt_amp_init function inside the traces, so I opened an issue here.

System Info

Hardware: MSI Prestige 16 Flip AI+
Distro: Arch Linux
Kernel Version: 7.1.6-1-cachyos