linux-kernel - Re: [PATCH] ASoC: intel: avs: Fix potential memory leak in avs_pci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <18c161e8-974b-4a4c-9ef2-c2cacef481b5@intel.com>
Date: Thu, 13 Nov 2025 12:14:30 +0100
From: Cezary Rojewski <cezary.rojewski@...el.com>
To: Abdun Nihaal <nihaal@....iitm.ac.in>
CC: <liam.r.girdwood@...ux.intel.com>, <peter.ujfalusi@...ux.intel.com>,
	<yung-chuan.liao@...ux.intel.com>, <ranjani.sridharan@...ux.intel.com>,
	<kai.vehmanen@...ux.intel.com>, <pierre-louis.bossart@...ux.dev>,
	<broonie@...nel.org>, <perex@...ex.cz>, <tiwai@...e.com>,
	<linux-sound@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] ASoC: intel: avs: Fix potential memory leak in
 avs_pci_probe()

On 2025-11-13 11:41 AM, Abdun Nihaal wrote:
> In snd_hdac_ext_bus_get_ml_capabilities(), memory is allocated for
> multiple hdac_ext_link structures, and appended to bus->hlink_list.
> But the subsequent error paths in avs_pci_probe() don't free them.
> 
> Fix this by calling snd_hdac_ext_link_free_all() on the error path.
> Also handle the return code of snd_hdac_ext_bus_get_ml_capabilities()
> correctly, since it can return -ENOMEM.

I'd suggest to be strict, no need for lengthy message when addressing 
simple problem. Your title already answers _what_?, the message shall 
answer _why_?. Example:

snd_hdac_ext_bus_get_ml_capabilities() may fail when allocating LINK 
resources.

> 
> Fixes: 1affc44ea5dd ("ASoC: Intel: avs: PCI driver implementation")
> Signed-off-by: Abdun Nihaal <nihaal@....iitm.ac.in>
> ---
> Compile tested only. Issue found using static analysis.

Well, it's good to do at least a simple functional test before sending, 
see below.

> 
>   sound/soc/intel/avs/core.c | 11 +++++++++--
>   1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c
> index 6e0e65584c7f..ece78a1c0e42 100644
> --- a/sound/soc/intel/avs/core.c
> +++ b/sound/soc/intel/avs/core.c
> @@ -473,8 +473,13 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
>   	}
>   
>   	snd_hdac_bus_parse_capabilities(bus);
> -	if (bus->mlcap)
> -		snd_hdac_ext_bus_get_ml_capabilities(bus);
> +	if (bus->mlcap) {
> +		ret = snd_hdac_ext_bus_get_ml_capabilities(bus);
> +		if (ret < 0) {

Just 'if (ret)' here.

> +			dev_err(dev, "failed to get multilink capabilities: %d\n", ret);
> +			goto err_ml_capabilities;
> +		}
> +	}
>   
>   	if (dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)))
>   		dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
> @@ -516,6 +521,8 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
>   	snd_hdac_bus_free_stream_pages(bus);
>   	snd_hdac_ext_stream_free_all(bus);
>   err_init_streams:
> +	snd_hdac_ext_link_free_all(bus);
> +err_ml_capabilities:

Don't believe that's correct. -ENOMEM may be returned when allocating 
resources for an entry N>0. Skipping snd_hdac_ext_link_free_all() may 
leave things at status quo - memory leak.

>   	iounmap(adev->dsp_ba);
>   err_remap_bar4:
>   	iounmap(bus->remap_addr);