devm_kcalloc() may fail. mt8365_afe_suspend() uses afe->reg_back_up
unconditionally after allocation and writes afe->reg_back_up[i], which
can lead to a NULL pointer dereference under low-memory conditions.

Add a NULL check and bail out with -ENOMEM, making sure to disable the
main clock via the existing error path to keep clock state balanced.

Fixes: e1991d102bc2 ("ASoC: mediatek: mt8365: Add the AFE driver support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 sound/soc/mediatek/mt8365/mt8365-afe-pcm.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/sound/soc/mediatek/mt8365/mt8365-afe-pcm.c b/sound/soc/mediatek/mt8365/mt8365-afe-pcm.c
index 10793bbe9275..9f398d1249ce 100644
--- a/sound/soc/mediatek/mt8365/mt8365-afe-pcm.c
+++ b/sound/soc/mediatek/mt8365/mt8365-afe-pcm.c
@@ -1971,22 +1971,26 @@ static int mt8365_afe_suspend(struct device *dev)
 {
 	struct mtk_base_afe *afe = dev_get_drvdata(dev);
 	struct regmap *regmap = afe->regmap;
-	int i;
+	int i, ret = 0;
 
 	mt8365_afe_enable_main_clk(afe);
 
-	if (!afe->reg_back_up)
-		afe->reg_back_up =
-			devm_kcalloc(dev, afe->reg_back_up_list_num,
-				     sizeof(unsigned int), GFP_KERNEL);
+	if (!afe->reg_back_up) {
+		afe->reg_back_up = devm_kcalloc(dev, afe->reg_back_up_list_num,
+						sizeof(unsigned int), GFP_KERNEL);
+		if (!afe->reg_back_up) {
+			ret = -ENOMEM;
+			goto out_disable_clk;
+		}
+	}
 
 	for (i = 0; i < afe->reg_back_up_list_num; i++)
 		regmap_read(regmap, afe->reg_back_up_list[i],
 			    &afe->reg_back_up[i]);
-
+out_disable_clk:
 	mt8365_afe_disable_main_clk(afe);
 
-	return 0;
+	return ret;
 }
 
 static int mt8365_afe_resume(struct device *dev)
-- 
2.43.0

Il 18/09/25 16:07, Guangshuo Li ha scritto:
> devm_kcalloc() may fail. mt8365_afe_suspend() uses afe->reg_back_up
> unconditionally after allocation and writes afe->reg_back_up[i], which
> can lead to a NULL pointer dereference under low-memory conditions.
> 
> Add a NULL check and bail out with -ENOMEM, making sure to disable the
> main clock via the existing error path to keep clock state balanced.
> 
> Fixes: e1991d102bc2 ("ASoC: mediatek: mt8365: Add the AFE driver support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>   sound/soc/mediatek/mt8365/mt8365-afe-pcm.c | 18 +++++++++++-------
>   1 file changed, 11 insertions(+), 7 deletions(-)
> 
> diff --git a/sound/soc/mediatek/mt8365/mt8365-afe-pcm.c b/sound/soc/mediatek/mt8365/mt8365-afe-pcm.c
> index 10793bbe9275..9f398d1249ce 100644
> --- a/sound/soc/mediatek/mt8365/mt8365-afe-pcm.c
> +++ b/sound/soc/mediatek/mt8365/mt8365-afe-pcm.c
> @@ -1971,22 +1971,26 @@ static int mt8365_afe_suspend(struct device *dev)
>   {
>   	struct mtk_base_afe *afe = dev_get_drvdata(dev);
>   	struct regmap *regmap = afe->regmap;
> -	int i;
> +	int i, ret = 0;
>   
>   	mt8365_afe_enable_main_clk(afe);
>   
> -	if (!afe->reg_back_up)
> -		afe->reg_back_up =
> -			devm_kcalloc(dev, afe->reg_back_up_list_num,
> -				     sizeof(unsigned int), GFP_KERNEL);
> +	if (!afe->reg_back_up) {
> +		afe->reg_back_up = devm_kcalloc(dev, afe->reg_back_up_list_num,
> +						sizeof(unsigned int), GFP_KERNEL);

Nothing else can fail, so using a label here is unnecessary.

		if (!afe->reg_back_up) {
			mt8365_afe_disable_main_clk(afe);
			return -ENOMEM;
		}

This makes you able to avoid adding a `ret` variable, and also the goto.

Cheers,
Angelo