In preparation for making the kmalloc family of allocators type aware,
we need to make sure that the returned type from the allocation matches
the type of the variable being assigned. (Before, the allocator would
always return "void *", which can be implicitly cast to any pointer type.)

The assigned type is "struct snd_sof_pipeline **", but the returned type
will be "struct snd_sof_widget **". These are the same size allocation
(pointer size) but the types don't match. Adjust the allocation type to
match the assignment.

Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Cc: Bard Liao <yung-chuan.liao@linux.intel.com>
Cc: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Cc: Daniel Baluta <daniel.baluta@nxp.com>
Cc: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Cc: Mark Brown <broonie@kernel.org>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: <sound-open-firmware@alsa-project.org>
Cc: <linux-sound@vger.kernel.org>
---
 sound/soc/sof/ipc4-pcm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/sof/ipc4-pcm.c b/sound/soc/sof/ipc4-pcm.c
index 1a2841899ff5..52903503cf3b 100644
--- a/sound/soc/sof/ipc4-pcm.c
+++ b/sound/soc/sof/ipc4-pcm.c
@@ -784,7 +784,8 @@ static int sof_ipc4_pcm_setup(struct snd_sof_dev *sdev, struct snd_sof_pcm *spcm
 
 		/* allocate memory for max number of pipeline IDs */
 		pipeline_list->pipelines = kcalloc(ipc4_data->max_num_pipelines,
-						   sizeof(struct snd_sof_widget *), GFP_KERNEL);
+						   sizeof(*pipeline_list->pipelines),
+						   GFP_KERNEL);
 		if (!pipeline_list->pipelines) {
 			sof_ipc4_pcm_free(sdev, spcm);
 			return -ENOMEM;
-- 
2.34.1

On Fri, 25 Apr 2025 23:25:12 -0700, Kees Cook wrote:
> In preparation for making the kmalloc family of allocators type aware,
> we need to make sure that the returned type from the allocation matches
> the type of the variable being assigned. (Before, the allocator would
> always return "void *", which can be implicitly cast to any pointer type.)
> 
> The assigned type is "struct snd_sof_pipeline **", but the returned type
> will be "struct snd_sof_widget **". These are the same size allocation
> (pointer size) but the types don't match. Adjust the allocation type to
> match the assignment.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next

Thanks!

[1/1] ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation type
      commit: 00a371adbbfb46db561db85a9d7b53b2363880a1

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark

On 26/04/2025 09:25, Kees Cook wrote:
> In preparation for making the kmalloc family of allocators type aware,
> we need to make sure that the returned type from the allocation matches
> the type of the variable being assigned. (Before, the allocator would
> always return "void *", which can be implicitly cast to any pointer type.)
> 
> The assigned type is "struct snd_sof_pipeline **", but the returned type
> will be "struct snd_sof_widget **". These are the same size allocation
> (pointer size) but the types don't match. Adjust the allocation type to
> match the assignment.

It looks like that this is indeed an oversight and a bug introduced by a
mostly mechanical change (introduced in v6.3).

Can you add:
Fixes: 9c04363d222b ("ASoC: SOF: Introduce struct snd_sof_pipeline")

and:
Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
> Signed-off-by: Kees Cook <kees@kernel.org>
> ---
> Cc: Liam Girdwood <lgirdwood@gmail.com>
> Cc: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
> Cc: Bard Liao <yung-chuan.liao@linux.intel.com>
> Cc: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
> Cc: Daniel Baluta <daniel.baluta@nxp.com>
> Cc: Kai Vehmanen <kai.vehmanen@linux.intel.com>
> Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
> Cc: Mark Brown <broonie@kernel.org>
> Cc: Jaroslav Kysela <perex@perex.cz>
> Cc: Takashi Iwai <tiwai@suse.com>
> Cc: <sound-open-firmware@alsa-project.org>
> Cc: <linux-sound@vger.kernel.org>
> ---
>  sound/soc/sof/ipc4-pcm.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/sound/soc/sof/ipc4-pcm.c b/sound/soc/sof/ipc4-pcm.c
> index 1a2841899ff5..52903503cf3b 100644
> --- a/sound/soc/sof/ipc4-pcm.c
> +++ b/sound/soc/sof/ipc4-pcm.c
> @@ -784,7 +784,8 @@ static int sof_ipc4_pcm_setup(struct snd_sof_dev *sdev, struct snd_sof_pcm *spcm
>  
>  		/* allocate memory for max number of pipeline IDs */
>  		pipeline_list->pipelines = kcalloc(ipc4_data->max_num_pipelines,
> -						   sizeof(struct snd_sof_widget *), GFP_KERNEL);
> +						   sizeof(*pipeline_list->pipelines),
> +						   GFP_KERNEL);
>  		if (!pipeline_list->pipelines) {
>  			sof_ipc4_pcm_free(sdev, spcm);
>  			return -ENOMEM;

-- 
Péter

On Mon, Apr 28, 2025 at 03:38:30PM +0300, Péter Ujfalusi wrote:
> 
> 
> On 26/04/2025 09:25, Kees Cook wrote:
> > In preparation for making the kmalloc family of allocators type aware,
> > we need to make sure that the returned type from the allocation matches
> > the type of the variable being assigned. (Before, the allocator would
> > always return "void *", which can be implicitly cast to any pointer type.)
> > 
> > The assigned type is "struct snd_sof_pipeline **", but the returned type
> > will be "struct snd_sof_widget **". These are the same size allocation
> > (pointer size) but the types don't match. Adjust the allocation type to
> > match the assignment.
> 
> It looks like that this is indeed an oversight and a bug introduced by a
> mostly mechanical change (introduced in v6.3).
> 
> Can you add:
> Fixes: 9c04363d222b ("ASoC: SOF: Introduce struct snd_sof_pipeline")
> 
> and:
> Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>

Thanks! I can carry the patch if you'd like? I assumed this would go
through regular maintainers.

-Kees

-- 
Kees Cook