linux-kernel - [PATCH] ASoC: intel: avs: Fix potential memory leak in avs_pci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251113104121.79484-1-nihaal@cse.iitm.ac.in>
Date: Thu, 13 Nov 2025 16:11:19 +0530
From: Abdun Nihaal <nihaal@....iitm.ac.in>
To: cezary.rojewski@...el.com
Cc: Abdun Nihaal <nihaal@....iitm.ac.in>,
	liam.r.girdwood@...ux.intel.com,
	peter.ujfalusi@...ux.intel.com,
	yung-chuan.liao@...ux.intel.com,
	ranjani.sridharan@...ux.intel.com,
	kai.vehmanen@...ux.intel.com,
	pierre-louis.bossart@...ux.dev,
	broonie@...nel.org,
	perex@...ex.cz,
	tiwai@...e.com,
	linux-sound@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] ASoC: intel: avs: Fix potential memory leak in avs_pci_probe()

In snd_hdac_ext_bus_get_ml_capabilities(), memory is allocated for
multiple hdac_ext_link structures, and appended to bus->hlink_list.
But the subsequent error paths in avs_pci_probe() don't free them.

Fix this by calling snd_hdac_ext_link_free_all() on the error path.
Also handle the return code of snd_hdac_ext_bus_get_ml_capabilities()
correctly, since it can return -ENOMEM.

Fixes: 1affc44ea5dd ("ASoC: Intel: avs: PCI driver implementation")
Signed-off-by: Abdun Nihaal <nihaal@....iitm.ac.in>
---
Compile tested only. Issue found using static analysis.

 sound/soc/intel/avs/core.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c
index 6e0e65584c7f..ece78a1c0e42 100644
--- a/sound/soc/intel/avs/core.c
+++ b/sound/soc/intel/avs/core.c
@@ -473,8 +473,13 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
 	}
 
 	snd_hdac_bus_parse_capabilities(bus);
-	if (bus->mlcap)
-		snd_hdac_ext_bus_get_ml_capabilities(bus);
+	if (bus->mlcap) {
+		ret = snd_hdac_ext_bus_get_ml_capabilities(bus);
+		if (ret < 0) {
+			dev_err(dev, "failed to get multilink capabilities: %d\n", ret);
+			goto err_ml_capabilities;
+		}
+	}
 
 	if (dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)))
 		dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
@@ -516,6 +521,8 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
 	snd_hdac_bus_free_stream_pages(bus);
 	snd_hdac_ext_stream_free_all(bus);
 err_init_streams:
+	snd_hdac_ext_link_free_all(bus);
+err_ml_capabilities:
 	iounmap(adev->dsp_ba);
 err_remap_bar4:
 	iounmap(bus->remap_addr);
-- 
2.43.0