linux-kernel - Re: [PATCH] ASoC: wcd934x: fix error handling in wcd934x_codec_parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <lqgi66r4voh5z4p7mrjiulxvy6gky6mzn6rq2yresuhqfzsnt3@xcgvnxxd7qnq>
Date: Sun, 21 Sep 2025 14:43:40 +0300
From: Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>
To: Ma Ke <make24@...as.ac.cn>
Cc: srini@...nel.org, lgirdwood@...il.com, broonie@...nel.org, perex@...ex.cz,
        tiwai@...e.com, pierre-louis.bossart@...ux.dev,
        linux-sound@...r.kernel.org, linux-arm-msm@...r.kernel.org,
        linux-kernel@...r.kernel.org, akpm@...ux-foundation.org,
        stable@...r.kernel.org
Subject: Re: [PATCH] ASoC: wcd934x: fix error handling in
 wcd934x_codec_parse_data()

On Sun, Sep 21, 2025 at 05:59:27PM +0800, Ma Ke wrote:
> wcd934x_codec_parse_data() contains a device reference count leak in
> of_slim_get_device() where device_find_child() increases the reference
> count of the device but this reference is not properly decreased in
> the success path. Add put_device() in wcd934x_codec_parse_data(),
> which ensures that the reference count of the device is correctly
> managed.
> 
> Calling path: of_slim_get_device() -> of_find_slim_device() ->
> device_find_child(). As comment of device_find_child() says, 'NOTE:
> you will need to drop the reference with put_device() after use.'.
> 
> Found by code review.
> 
> Cc: stable@...r.kernel.org
> Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec")
> Signed-off-by: Ma Ke <make24@...as.ac.cn>
> ---
>  sound/soc/codecs/wcd934x.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c
> index 1bb7e1dc7e6b..9ffa65329934 100644
> --- a/sound/soc/codecs/wcd934x.c
> +++ b/sound/soc/codecs/wcd934x.c
> @@ -5849,10 +5849,13 @@ static int wcd934x_codec_parse_data(struct wcd934x_codec *wcd)
>  	slim_get_logical_addr(wcd->sidev);
>  	wcd->if_regmap = regmap_init_slimbus(wcd->sidev,
>  				  &wcd934x_ifc_regmap_config);

regmap code doesn't increase refcount of the device, so we need to keep
the reference till the remove time. The code also leaks the memory for
regmap, so this code needs additional fixes anyway.

> -	if (IS_ERR(wcd->if_regmap))
> +	if (IS_ERR(wcd->if_regmap)) {
> +		put_device(&wcd->sidev->dev);

This call is correct

>  		return dev_err_probe(dev, PTR_ERR(wcd->if_regmap),
>  				     "Failed to allocate ifc register map\n");
> +	}
>  
> +	put_device(&wcd->sidev->dev);

But this one needs to be deferred until remove time (e.g. by using
devres)

>  	of_property_read_u32(dev->parent->of_node, "qcom,dmic-sample-rate",
>  			     &wcd->dmic_sample_rate);
>  
> -- 
> 2.17.1
> 

-- 
With best wishes
Dmitry