From nobody Sun May 24 23:31:54 2026 Received: from mail-dy1-f177.google.com (mail-dy1-f177.google.com [74.125.82.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 593C53E0C71 for ; Wed, 20 May 2026 12:48:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779281300; cv=none; b=eeJ75K9UnQe1BOJ0gbYZ0xqhywATmm/VEtgww7Ytm9Pjj8JKGqyRObVaZ6jJBcBWGeWD1DE30quFrUdqq69FEhesahYTLEkpqB9l/nw1dWhyA6o4NVlDF3MZ0XxS93F86E7yNq2SXouaC9uDheNhlHJg+gJxfs29iW5xhuFp3P0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779281300; c=relaxed/simple; bh=pzF0og71GCMqa1o7+nozJoEdON5VIbd9T9osgpd0uKQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=UZuDTvFhjbg97Ev5hDhAB/wyyDWG2dR2VJrp6f/0d8lkPwcKOJFk1w/WSX6AjeR3udLbojIEegL1k+gIJsw6rEOORFVN5iZiUzj3k4okGfbwKTPmrwrpKuR1aNMg+LIJZCho8BEPD6rxQGptHMUZVDpohWtPzusn+wlYgjO/PdU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qnxAEFk2; arc=none smtp.client-ip=74.125.82.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qnxAEFk2" Received: by mail-dy1-f177.google.com with SMTP id 5a478bee46e88-303f2fb7225so2972023eec.1 for ; Wed, 20 May 2026 05:48:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779281298; x=1779886098; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=55N8gJPbgFI+xmT9kNqqCzucTvZ42KxOQy3IwLLODuA=; b=qnxAEFk2Yx2YwmYXwVqPGAyiUtmjZXXy0wm9C+rpwc5HPiH63thtC9exGxNMY5UkJU lwjRUd7myRj8i9OoGvr7+BdYJ6jx0hiElRR2JzhEFuT3CSXVBbrdu2mpU1pzd5eN7umb C82sNSURZLo4ckA2+yECRJ23fRww+QcmZ7hiWKTGzaQ6Z83Z/khJJk6/A19VI9ABHF/x OKfhwqtIgY7bP8QFIvK9I/JguHU7VYurcphTIcQuDT9WrNOnXm++QRcmkJSZFfymuYWP W9Fg7+bAOrQDFRwi9CVlvZRsyh8bKRzrV8whxO65n+hPS7V/Dok8Mezy9yAZ8GuAsjOC FR4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779281298; x=1779886098; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=55N8gJPbgFI+xmT9kNqqCzucTvZ42KxOQy3IwLLODuA=; b=XhDdUUJXW7JgYjUmIGeg7SPDJ/LQ0FA2PmL1b/GDDYwK9z/6FM68en/Apnu1Do3x5f jBW3m8dKpSZC/q8pm5yC9S7VHH5vsbIDTw1NphOv8v0UfuL8TUCNE1bYXKa/mc4m6UXS hQq+bxuLglSVVOXSseUlotYo8uJ6S9bGcqS+UKK80tfyo3h/YuhuiBDtvDL8hRHAljAL VP9MeImBF0DMWXcrnLXfhp2+rOLAo/kF0YKXQyYtMD2BjnD/AQlxsBL3EyubOJ1jn3Rr Fzt/wSfkcJWlvvnlYXefg1mFmYWnC0Akvyh0jhtXA2gFoDjqV9rBmQyvTvKPZzf0hLwE DCrg== X-Forwarded-Encrypted: i=1; AFNElJ9UHTTqq5txciEEpE43P5PcQSKcY3GWunXwqMdt7uP6IK3nvxLKESCRNHuqBkPSiq8GE6IQZpu9B+EMI7U=@vger.kernel.org X-Gm-Message-State: AOJu0YwIiHJpl8E9EIzENt2UOwqvXe3x49xTvUSbT9qrkH1ngS1zyMv/ Fs6ZCJxrG7CFSlc+e3+g+vxUzL4VPw3YcMH1af+L93rLEy9T4rPvsczFeCbicg2m X-Gm-Gg: Acq92OGLtavxTYuGzWQ2YfhVreuIvKxuiVpxet+In7buJ7jC9q2dhWkjpUbb+sRiwfF KVTXgSqMePquvTpjH4qJAZ0uksEXLkkM0mmhj9enHD8Ypx5JmiDx6tFlhEbrnYlmCXMUzsqmRYQ /cA31mXJypqX1pQwcjV8BDFOgxOt2jbX4UCQipvruSSJAKPP+A3vmCQG7uM7gMQRRL+7V1N3TA3 McUr3X4R7ksp24IMGrn/Vj5q2uY1rsy3vGv0/XsYCBRMhr1SxXb0zLJcp0mJqXwUTeDkEvcOly2 jMjRWmTbaSqSgR2tk+Yadtf95v3prr/zazWdFRNPwEfILV1M8sOUmtpRkSze7bs7T10y34xqYyZ peWYZP7BqAYm8H+2NGhGdxbXDm7OBdJw7MM1mX8OcAagaxAuUIrs6CedMwOHbbuy2Iiu3ujT+S8 F+B1Qs4hAffix45obix1UjZMwaYNOAsWzWjnOBVO6wszGesWlIbC4mKhGLymzBOMEAm/HGROy/o A== X-Received: by 2002:a05:7301:7c0b:b0:2ed:e14:42e5 with SMTP id 5a478bee46e88-303986ba6e1mr9711834eec.30.1779281298257; Wed, 20 May 2026 05:48:18 -0700 (PDT) Received: from [192.168.1.18] (177-4-162-74.user3p.v-tal.net.br. [177.4.162.74]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-302944ffb85sm19114045eec.7.2026.05.20.05.48.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 May 2026 05:48:17 -0700 (PDT) From: =?utf-8?q?C=C3=A1ssio_Gabriel?= Date: Wed, 20 May 2026 09:48:00 -0300 Subject: [PATCH 1/2] ALSA: hda: cs35l56: Free ACPI _SUB string on errors Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260520-alsa-cs35l56-system-name-leak-v1-1-d13b54423198@gmail.com> References: <20260520-alsa-cs35l56-system-name-leak-v1-0-d13b54423198@gmail.com> In-Reply-To: <20260520-alsa-cs35l56-system-name-leak-v1-0-d13b54423198@gmail.com> To: David Rhodes , Richard Fitzgerald , Takashi Iwai , Jaroslav Kysela , Simon Trimmer , Mark Brown Cc: linux-sound@vger.kernel.org, patches@opensource.cirrus.com, linux-kernel@vger.kernel.org, =?utf-8?q?C=C3=A1ssio_Gabriel?= X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=2859; i=cassiogabrielcontato@gmail.com; h=from:subject:message-id; bh=pzF0og71GCMqa1o7+nozJoEdON5VIbd9T9osgpd0uKQ=; b=owGbwMvMwCV2IdZeKur/u2bG02pJDFm8a7s735i2c21lPW5pWnDxZHjp3NqHp4PLFvPLsizqk 1z0vrKjo5SFQYyLQVZMkWV10iLLPV0PrtbHrfCAmcPKBDKEgYtTACbyt5WR4ZL1VVNP7rNlz0sb Vnft6Y60nvU0WGfDPe+FlzOig60+hDL80zvlx2OQnp+tNiOh3W/3MrXJryKU/kke2Cfu1r3owSs BDgA= X-Developer-Key: i=cassiogabrielcontato@gmail.com; a=openpgp; fpr=AB62A239BC8AE0D57F5EA848D05D3F1A5AFFEE83 cs35l56_hda_read_acpi() gets an allocated ACPI _SUB string from acpi_get_subsystem_id(). On success, that string is either transferred to cs35l56->system_name or freed after constructing a speaker-ID-specific firmware name. Several error paths after the _SUB lookup return without releasing the allocated string. This includes speaker ID lookup errors other than -ENOENT, and errors after _SUB is read but before ownership is transferred to cs35l56->system_name. Free the temporary _SUB string on those error paths. If ownership has already been transferred to cs35l56->system_name, free that member and clear it before returning the error. Fixes: 6f03b446cbae ("ALSA: hda: cs35l56: Add support for speaker id") Fixes: 40b1c2f9b299 ("ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo= Yoga Book 9i GenX") Signed-off-by: C=C3=A1ssio Gabriel --- sound/hda/codecs/side-codecs/cs35l56_hda.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/sound/hda/codecs/side-codecs/cs35l56_hda.c b/sound/hda/codecs/= side-codecs/cs35l56_hda.c index cdbc576569ef..7b5fc63eeaa8 100644 --- a/sound/hda/codecs/side-codecs/cs35l56_hda.c +++ b/sound/hda/codecs/side-codecs/cs35l56_hda.c @@ -1050,7 +1050,7 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda *= cs35l56, int hid, int id) sub =3D acpi_get_subsystem_id(ACPI_HANDLE(cs35l56->base.dev)); ret =3D cs35l56_hda_apply_platform_fixups(cs35l56, sub, &id); if (ret) - return ret; + goto err_free_sub; =20 if (cs35l56->index =3D=3D -1) { property =3D "cirrus,dev-index"; @@ -1102,7 +1102,7 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda *= cs35l56, int hid, int id) if (!cs35l56->system_name) return -ENOMEM; } else { - return ret; + goto err_free_sub; } } =20 @@ -1117,8 +1117,11 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda = *cs35l56, int hid, int id) * If RESET is shared the first amp to probe will grab the reset * line and reset all the amps */ - if (ret !=3D -EBUSY) - return dev_err_probe(cs35l56->base.dev, ret, "Failed to get reset GPIO\= n"); + if (ret !=3D -EBUSY) { + ret =3D dev_err_probe(cs35l56->base.dev, ret, + "Failed to get reset GPIO\n"); + goto err_free_system_name; + } =20 dev_info(cs35l56->base.dev, "Reset GPIO busy, assume shared reset\n"); cs35l56->base.reset_gpio =3D NULL; @@ -1126,10 +1129,20 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda= *cs35l56, int hid, int id) =20 return 0; =20 +err_free_system_name: + kfree(cs35l56->system_name); + cs35l56->system_name =3D NULL; + + return ret; + err: if (ret !=3D -ENODEV) dev_err(cs35l56->base.dev, "Failed property %s: %d\n", property, ret); =20 +err_free_sub: + if (!IS_ERR(sub)) + kfree(sub); + return ret; } =20 --=20 2.54.0 From nobody Sun May 24 23:31:54 2026 Received: from mail-dy1-f175.google.com (mail-dy1-f175.google.com [74.125.82.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD6A53E16A6 for ; Wed, 20 May 2026 12:48:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779281304; cv=none; b=dEl5U1c7owV4v4Z/1lcHLNVmR7IqiPSOWCEy3kz72DEB0XwCwx46s59y33jyCc5Z27d7kFeM6kqeKeP73+McPIR+pdUW8Lx2Kgd7k4RP/D9PnwocNP1swvefWDAET/L3CafribKZ+6R5nRQam+6wxhOZZ3Q7LuxHTLHsO3SqsZE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779281304; c=relaxed/simple; bh=3gHsCzYbLDcxVrXk4h8bH/q8GSKvp/BnBAcEsrn5pRE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Lg5uDj1J5SBPbJ0JVM7iDP1y5T8N6hpCO6l8hv0q/8yF63+EYw+X6QP9Q8I7CSxDblrJqqTTRK3TO7UnY69Vwg41ecxs7WpMr1oKE0DXu0swQvbzW4FvYvkPZv2/Gj/6642CgOlxAH83qSI5zkt+tfdHrt9sjHU94OBadQYFg3Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ryfSzWcu; arc=none smtp.client-ip=74.125.82.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ryfSzWcu" Received: by mail-dy1-f175.google.com with SMTP id 5a478bee46e88-2c156c4a9efso6508811eec.1 for ; Wed, 20 May 2026 05:48:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779281302; x=1779886102; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=r2SIImlwAi8rmeAJzWSI7l3QGyNAkdGsuYsQTlZWh/c=; b=ryfSzWcuyA+aNFqCr0Lrl34ylilg1+ndFsR9iTG/AAcX/W/tyeUJxl3y0Wsbgh4kKd amVvm0Wcai3tXC5eKMj/uUmhActY7nytphdwnw6v6abCivof+Nj19aZtl7zKspudsy2t //0lrXE7LWPlhTGr+JsKiaRjJ/PirVS/d9Rc4L9bneoZUwDNLmQWOAcu5pafEufILt1z toadKmGdANI3P5lrbT2qVlzVwfIJ/W5suL0RySqmUM3ZQb0aAFYfzGq4n6PtMB58O+eE idRpbIl7v+34fu7sBjxYyQR86BZajm7gvQlMpb84bReo9KWOPLYluljZhwjHOCkiQGmV fq7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779281302; x=1779886102; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=r2SIImlwAi8rmeAJzWSI7l3QGyNAkdGsuYsQTlZWh/c=; b=l6SdICcIOfvBUCOfuIKt9dT9hyYBfz6esw4QvYe3m5reZDM0FgL/4dpgeEWKjgWE8h cIj3zKcF6X3eLVY0zzY4URkMyoS6P9yvpqbGvDu5vutVVvjlB9XT6V9RHyenzjnwbrDo CMYpQ+vuh97hM2oThgx427eOAyIg0K+Rbyvpd/iY+VHwm1jXSAAmZO13Y2GHf245XpF4 szYkR9Y7KGvFRb+RB5W3bx4naWJsNPd8uwOuLMDpGxlinY+L7D/HhhHmsjeV5Codf+J+ IOf9xtMO6WxNc8U3h+AqYDCHEARem0zTVx+zXU+g6QqARow+i5q/l2DAxvgQoUn/eUYM SGVA== X-Forwarded-Encrypted: i=1; AFNElJ/zN2QFU66PYNWkCpdUVD6o7T9bQ/wH/48k9blBPY5bn7SkM5Xq0bc10EcKshhOEmzr39MxOxR4KffP4uc=@vger.kernel.org X-Gm-Message-State: AOJu0YwhgtEGE9pq5m87vihnardzAmlbl+RkbE5NMP819vsErCX6+zlU bq7et8DJwaTmDKCPyxwnB0x7grNJxC/qJayJ15Plue9T1b7NXq/Qr8U+pm+WLR4j X-Gm-Gg: Acq92OHYrWaBjA3sa/t6KOBEkgRw4eEHpxzHvuUbTS8pcYvJQwthWgLHjqyjKG11W17 kmH6hrraSC6YKaffXdw9ccDvdNKLEj67ezt9h8bVw+D+wFKmL1fIrPffTic09jVwhnOCoMQU6eE IJdw6jBGSAslXkdXTzn/E0lmvRp0aq6WvGrds9d1LQkAILIjgq3PjJVH7KIKuSSLjoQ3UQRkb4m 4n+EtYI4dnmHMvC7PqMZAlKIxuF68kEAHKXLsRrmJrgLC+JIPbp2b7XMnDbLXSlVvqeJRjtOgke Ij9pwatHswmljuD1LDrAkN/nVt767Gwnu3I4mE7e/PTTBX9SCBilQ4zlLmW6A/6TJNYWrt9VSFI 3rYx9NP7OYHCwqrKlV4Vwq0ppZVht7WBlYihWOHhWohOb2jsFcQhhA4JKiEa/kaJoduFXA/HDjO fr1JmRsnMOY4B/ENTuIcBK1CmgjGoxslLzGVezD+WfOHO+c3MtMgsQ62wQCt/jClEiTQ/yD05Qe g== X-Received: by 2002:a05:7300:641b:b0:2ef:83d4:647f with SMTP id 5a478bee46e88-3039865213amr10495042eec.25.1779281301890; Wed, 20 May 2026 05:48:21 -0700 (PDT) Received: from [192.168.1.18] (177-4-162-74.user3p.v-tal.net.br. [177.4.162.74]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-302944ffb85sm19114045eec.7.2026.05.20.05.48.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 May 2026 05:48:21 -0700 (PDT) From: =?utf-8?q?C=C3=A1ssio_Gabriel?= Date: Wed, 20 May 2026 09:48:01 -0300 Subject: [PATCH 2/2] ALSA: hda: cs35l56: Free system name on probe errors Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260520-alsa-cs35l56-system-name-leak-v1-2-d13b54423198@gmail.com> References: <20260520-alsa-cs35l56-system-name-leak-v1-0-d13b54423198@gmail.com> In-Reply-To: <20260520-alsa-cs35l56-system-name-leak-v1-0-d13b54423198@gmail.com> To: David Rhodes , Richard Fitzgerald , Takashi Iwai , Jaroslav Kysela , Simon Trimmer , Mark Brown Cc: linux-sound@vger.kernel.org, patches@opensource.cirrus.com, linux-kernel@vger.kernel.org, =?utf-8?q?C=C3=A1ssio_Gabriel?= X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1100; i=cassiogabrielcontato@gmail.com; h=from:subject:message-id; bh=3gHsCzYbLDcxVrXk4h8bH/q8GSKvp/BnBAcEsrn5pRE=; b=owGbwMvMwCV2IdZeKur/u2bG02pJDFm8a7s3d+axv0/IzZG4MGk5j62o7Qfd13OcqpwfXP4pl /S69bV5RykLgxgXg6yYIsvqpEWWe7oeXK2PW+EBM4eVCWQIAxenAExkWw/Df2fZmy5L5df0tofr 91+cK6xi/Tzs3cqpcwU272cNeHRJ+Q0jw5QlSwWT3Zin8bBMjhbUMebPOnh7wnu/8415oUtcD2m WsAIA X-Developer-Key: i=cassiogabrielcontato@gmail.com; a=openpgp; fpr=AB62A239BC8AE0D57F5EA848D05D3F1A5AFFEE83 cs35l56_hda_read_acpi() stores an allocated firmware system name in cs35l56->system_name. The normal remove path frees it, but remove is not called if cs35l56_hda_common_probe() fails after read_acpi() has succeeded. Free cs35l56->system_name from the common probe error path and clear the pointer. Fixes: 73cfbfa9caea ("ALSA: hda/cs35l56: Add driver for Cirrus Logic CS35L5= 6 amplifier") Signed-off-by: C=C3=A1ssio Gabriel --- sound/hda/codecs/side-codecs/cs35l56_hda.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/hda/codecs/side-codecs/cs35l56_hda.c b/sound/hda/codecs/= side-codecs/cs35l56_hda.c index 7b5fc63eeaa8..950241701eae 100644 --- a/sound/hda/codecs/side-codecs/cs35l56_hda.c +++ b/sound/hda/codecs/side-codecs/cs35l56_hda.c @@ -1250,6 +1250,8 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35= l56, int hid, int id) cs_dsp_remove(&cs35l56->cs_dsp); err: gpiod_set_value_cansleep(cs35l56->base.reset_gpio, 0); + kfree(cs35l56->system_name); + cs35l56->system_name =3D NULL; =20 return ret; } --=20 2.54.0