[v1] ASoC: intel: avs: Fix potential memory leak in avs_pci_probe()

[PATCH] ASoC: intel: avs: Fix potential memory leak in avs_pci_probe()

Posted by Abdun Nihaal 2 months, 3 weeks ago

In snd_hdac_ext_bus_get_ml_capabilities(), memory is allocated for
multiple hdac_ext_link structures, and appended to bus->hlink_list.
But the subsequent error paths in avs_pci_probe() don't free them.

Fix this by calling snd_hdac_ext_link_free_all() on the error path.
Also handle the return code of snd_hdac_ext_bus_get_ml_capabilities()
correctly, since it can return -ENOMEM.

Fixes: 1affc44ea5dd ("ASoC: Intel: avs: PCI driver implementation")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
Compile tested only. Issue found using static analysis.

 sound/soc/intel/avs/core.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c
index 6e0e65584c7f..ece78a1c0e42 100644
--- a/sound/soc/intel/avs/core.c
+++ b/sound/soc/intel/avs/core.c
@@ -473,8 +473,13 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
 	}
 
 	snd_hdac_bus_parse_capabilities(bus);
-	if (bus->mlcap)
-		snd_hdac_ext_bus_get_ml_capabilities(bus);
+	if (bus->mlcap) {
+		ret = snd_hdac_ext_bus_get_ml_capabilities(bus);
+		if (ret < 0) {
+			dev_err(dev, "failed to get multilink capabilities: %d\n", ret);
+			goto err_ml_capabilities;
+		}
+	}
 
 	if (dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)))
 		dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
@@ -516,6 +521,8 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
 	snd_hdac_bus_free_stream_pages(bus);
 	snd_hdac_ext_stream_free_all(bus);
 err_init_streams:
+	snd_hdac_ext_link_free_all(bus);
+err_ml_capabilities:
 	iounmap(adev->dsp_ba);
 err_remap_bar4:
 	iounmap(bus->remap_addr);
-- 
2.43.0

Re: [PATCH] ASoC: intel: avs: Fix potential memory leak in avs_pci_probe()

Posted by Cezary Rojewski 2 months, 3 weeks ago

On 2025-11-13 11:41 AM, Abdun Nihaal wrote:
> In snd_hdac_ext_bus_get_ml_capabilities(), memory is allocated for
> multiple hdac_ext_link structures, and appended to bus->hlink_list.
> But the subsequent error paths in avs_pci_probe() don't free them.
> 
> Fix this by calling snd_hdac_ext_link_free_all() on the error path.
> Also handle the return code of snd_hdac_ext_bus_get_ml_capabilities()
> correctly, since it can return -ENOMEM.

I'd suggest to be strict, no need for lengthy message when addressing 
simple problem. Your title already answers _what_?, the message shall 
answer _why_?. Example:

snd_hdac_ext_bus_get_ml_capabilities() may fail when allocating LINK 
resources.

> 
> Fixes: 1affc44ea5dd ("ASoC: Intel: avs: PCI driver implementation")
> Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
> ---
> Compile tested only. Issue found using static analysis.

Well, it's good to do at least a simple functional test before sending, 
see below.

> 
>   sound/soc/intel/avs/core.c | 11 +++++++++--
>   1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c
> index 6e0e65584c7f..ece78a1c0e42 100644
> --- a/sound/soc/intel/avs/core.c
> +++ b/sound/soc/intel/avs/core.c
> @@ -473,8 +473,13 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
>   	}
>   
>   	snd_hdac_bus_parse_capabilities(bus);
> -	if (bus->mlcap)
> -		snd_hdac_ext_bus_get_ml_capabilities(bus);
> +	if (bus->mlcap) {
> +		ret = snd_hdac_ext_bus_get_ml_capabilities(bus);
> +		if (ret < 0) {

Just 'if (ret)' here.

> +			dev_err(dev, "failed to get multilink capabilities: %d\n", ret);
> +			goto err_ml_capabilities;
> +		}
> +	}
>   
>   	if (dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)))
>   		dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
> @@ -516,6 +521,8 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
>   	snd_hdac_bus_free_stream_pages(bus);
>   	snd_hdac_ext_stream_free_all(bus);
>   err_init_streams:
> +	snd_hdac_ext_link_free_all(bus);
> +err_ml_capabilities:

Don't believe that's correct. -ENOMEM may be returned when allocating 
resources for an entry N>0. Skipping snd_hdac_ext_link_free_all() may 
leave things at status quo - memory leak.

>   	iounmap(adev->dsp_ba);
>   err_remap_bar4:
>   	iounmap(bus->remap_addr);

Re: [PATCH] ASoC: intel: avs: Fix potential memory leak in avs_pci_probe()

Posted by Abdun Nihaal 2 months, 3 weeks ago

On Thu, Nov 13, 2025 at 12:14:30PM +0100, Cezary Rojewski wrote:
> I'd suggest to be strict, no need for lengthy message when addressing simple
> problem. Your title already answers _what_?, the message shall answer
> _why_?. Example:
> 
> snd_hdac_ext_bus_get_ml_capabilities() may fail when allocating LINK
> resources.

Sure, I'll shorten the commit message.

> > Compile tested only. Issue found using static analysis.
> 
> Well, it's good to do at least a simple functional test before sending, see
> below.

I don't have the hardware to test it.

> >   	snd_hdac_ext_stream_free_all(bus);
> >   err_init_streams:
> > +	snd_hdac_ext_link_free_all(bus);
> > +err_ml_capabilities:
> 
> Don't believe that's correct. -ENOMEM may be returned when allocating
> resources for an entry N>0. Skipping snd_hdac_ext_link_free_all() may leave
> things at status quo - memory leak.
> 
> >   	iounmap(adev->dsp_ba);

Yes, I missed that. Will fix it and send a v2 patch.
Thanks for reviewing.

Regards,
Nihaal