linux-kernel - [PATCH 1/3] ASoC: amd: acp6x-pdm-dma: free pdm device data on closing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250530164425.119102-2-pchelkin@ispras.ru>
Date: Fri, 30 May 2025 19:44:14 +0300
From: Fedor Pchelkin <pchelkin@...ras.ru>
To: Liam Girdwood <lgirdwood@...il.com>,
	Mark Brown <broonie@...nel.org>,
	Takashi Iwai <tiwai@...e.com>
Cc: Fedor Pchelkin <pchelkin@...ras.ru>,
	Jaroslav Kysela <perex@...ex.cz>,
	Vijendar Mukunda <Vijendar.Mukunda@....com>,
	Ravulapati Vishnu vardhan rao <Vishnuvardhanrao.Ravulapati@....com>,
	Pierre-Louis Bossart <pierre-louis.bossart@...ux.dev>,
	linux-sound@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org,
	stable@...r.kernel.org
Subject: [PATCH 1/3] ASoC: amd: acp6x-pdm-dma: free pdm device data on closing

Dynamic memory referenced by runtime->private_data pointer is allocated in
acp6x_pdm_dma_open() and needs to be freed in the corresponding ->close()
callback.

unreferenced object 0xffff88813525a940 (size 32):
  comm "pipewire", pid 1238, jiffies 4294728195
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 3c 03 00 c9 ff ff  ..........<.....
  backtrace (crc 14400236):
    __kmalloc_cache_noprof+0x3a3/0x490
    acp6x_pdm_dma_open+0x10d/0x680 [snd_acp6x_pdm_dma]
    snd_soc_component_open+0x71/0x150 [snd_soc_core]
    __soc_pcm_open+0x221/0xb40 [snd_soc_core]
    soc_pcm_open+0x99/0x110 [snd_soc_core]
    snd_pcm_open_substream+0x18b/0x4e0 [snd_pcm]
    snd_pcm_open+0x244/0x670 [snd_pcm]
    snd_pcm_capture_open+0x72/0xd0 [snd_pcm]
    chrdev_open+0x1eb/0x5e0
    do_dentry_open+0x494/0x1820
    vfs_open+0x7a/0x440
    do_open+0x3d0/0xd30
    path_openat+0x1d3/0x580
    do_filp_open+0x1c5/0x450
    do_sys_openat2+0xef/0x180
    __x64_sys_openat+0x10e/0x210

Found by Linux Verification Center (linuxtesting.org).

Fixes: ceb4fcc13ae5 ("ASoC: amd: add acp6x pdm driver dma ops")
Cc: stable@...r.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@...ras.ru>
---
 sound/soc/amd/yc/acp6x-pdm-dma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/amd/yc/acp6x-pdm-dma.c b/sound/soc/amd/yc/acp6x-pdm-dma.c
index ac758b90f441..167cd792d33d 100644
--- a/sound/soc/amd/yc/acp6x-pdm-dma.c
+++ b/sound/soc/amd/yc/acp6x-pdm-dma.c
@@ -275,9 +275,11 @@ static int acp6x_pdm_dma_close(struct snd_soc_component *component,
 			       struct snd_pcm_substream *substream)
 {
 	struct pdm_dev_data *adata = dev_get_drvdata(component->dev);
+	struct snd_pcm_runtime *runtime = substream->runtime;
 
 	acp6x_disable_pdm_interrupts(adata->acp6x_base);
 	adata->capture_stream = NULL;
+	kfree(runtime->private_data);
 	return 0;
 }
 
-- 
2.49.0