From nobody Sun May 24 20:35:27 2026 Received: from mail-dy1-f182.google.com (mail-dy1-f182.google.com [74.125.82.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C95EE242D7F for ; Thu, 21 May 2026 13:34:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779370461; cv=none; b=sMsTLJdzANa4WArCTKjvObXsw57pPGwdq2rBpDGZp70VwyMsAwCo/RnN2uyuGoCzHnNh6SLl944Q0zG4U2ePsbvGA815p86GKBCNr+vsdn+xGmjQJDrJMSKpYvCVA5dKA2xBgVDOpxci7+MlUPtF/x8DBRj/StnyfAe93f/d6lQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779370461; c=relaxed/simple; bh=gK5vRG3AhdnrAyb29uC9wmyCZlRnTbvlVjdqCKc94bA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=irK3/7Q4QU59op4L2ttp3p9NkZAGH/cN53v2WqIrey9nVY4QeVV7zwA15C9b3lVLeVnnz2bKFyirAQmBLPfy9EVl48WQFo5caSNcJ3P0jUi93bH5hhw3jDSXSak/0n1pHkdQ2Esi0GraFsjhv11rF3ErsV/WQ1qau71pGovhh2o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JZ9rEpf1; arc=none smtp.client-ip=74.125.82.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JZ9rEpf1" Received: by mail-dy1-f182.google.com with SMTP id 5a478bee46e88-3042dffd80bso1240972eec.0 for ; Thu, 21 May 2026 06:34:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779370459; x=1779975259; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=hzI/Ekgy0+pONVfm0czhGsoJW62Z+1OSx3Ehru5Xq6A=; b=JZ9rEpf1dIFr0qdNtIufqr8PjNT4vBxEuqi45gGMdQ9TQfy+8RoGBc47oF4CwbxPRY 25G7w6Ngp0KxTTOPsobN1Pz42CbkXKg3+w/I9Cat+HTb5ORmtonekKFVYWQpWBU4Q5qJ mbnMqLi+rCdT/o2ZGXY9myTzhx3akPk+j0hSH0VDSHGNn/H6v2HQKI3h0ZWMyONAHBBU AOu3mMrSSYrGntKBytN1WShoJLrr+p3vtFRGcNMETmjaebhzWPvoqDFu5B6TjK+8VyIq 1oTygVPz+zheNVyQmLmfpDi6pZzZyXz+MhxgEb02t592dDEbflETpbbR/NiCVTzphjPH RXvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779370459; x=1779975259; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=hzI/Ekgy0+pONVfm0czhGsoJW62Z+1OSx3Ehru5Xq6A=; b=nHXvNEwNVBQ5+us3v71w177ffGCNSFaD+tTclFEj/HEouuYqWWxjBxIY9iL+N7I97X S0J+f0hx8pN5nDoTSMyqdgdbvNR7J9/w/nvDLZbZGfSCjuFyzRLFneNRupFR0cfJIJdU btbXgqRQN5Kql6tTLGHpNuJxORpmJ1pWCh0fO+fe/xPlOUQ2a+Dco9OzOTYvXnNHsp8I 987NCz5pP5W2D+DcmNJaTGgiurE75NYak77TIrpRImFh2n0CpmiqmC7/VWkwTMHFxYbM 8PWjNbQKmF6wubzrqkhlzrw5TSK5abpUndEEkhavU7U1IQ1wXXRTavLdt73D4FRhSw86 V6XQ== X-Forwarded-Encrypted: i=1; AFNElJ/ydEI4Pof56xeZr+Ih0YnS1/qLHERBlVtYrdNl5gX4xuUmrN/kkdEkIpcWytmAQ20ipTK5jYcA/AOyugc=@vger.kernel.org X-Gm-Message-State: AOJu0Yywn5SU63YVClOhGOr4Wqnr4jRn7o5C1is736AJFvd3S+6MGZ2z Lwx1BA7DIvvnbD0XWwPsORWD6k+tGXd650qlG3ZLHXZyWvQtoIT+lykS X-Gm-Gg: Acq92OFa1laCWsVBFfbgY1Ih5XKiPaZyY49J5Bg7QR0irlrrZl5kAK0ozOmSMMnebbY C9FBiV7AExG4wJg3/bBTpQDldjG5Zol2meE2iSA4frI9mLsJKZa141J1DKyX7WAS01uE8VKAzk8 MBNsAEtPOiz4WogPB3tIseCeWctesM2t5Ps+Fe1X5uLVkW4Q5hx5krrxQCGd5zBg2mswBotaHq/ XAnPH1jk9WKOMKuVu6DVg0OtMP2YGQd7+tsWaumoAeqlwtgI4EBoZ+tn8rUxoUy0M+vxaYK6LO4 E2Bi5QjnMXk8eWAJ/Si/yMUjp7SKhSVIc+mpA5fG9rH5Hw/efOmRtbc5lN/9HVB2PRjBX62MeRQ TdZPtJwX3MrZldTOiM2zB3O9oeo3Tgxw6jJGeXzxIbuI5YrkgJ8oZ3UOl+IYUMxv9Ib2u7+bBwh mAgz1h+OJz49GQPC7xS+SuTKpHgKz3LglFpckhSg61WBHiiRUgYV+PKTHhEIT4JYbtMEWP+99fK Q== X-Received: by 2002:a05:7301:e8e:b0:2c1:6cfd:73ee with SMTP id 5a478bee46e88-3042f94d9femr1639663eec.24.1779370458794; Thu, 21 May 2026 06:34:18 -0700 (PDT) Received: from [192.168.1.18] (177-4-162-74.user3p.v-tal.net.br. [177.4.162.74]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3044330894fsm505067eec.8.2026.05.21.06.34.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 21 May 2026 06:34:18 -0700 (PDT) From: =?utf-8?q?C=C3=A1ssio_Gabriel?= Date: Thu, 21 May 2026 10:34:07 -0300 Subject: [PATCH v3] ALSA: hda: cs35l56: Fix system name string leaks Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260521-alsa-cs35l56-system-name-leak-v3-1-9dd4e2dcb473@gmail.com> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/5WOyw6CMBBFf4V07Zg+aBFX/odxUcoAVR6GQSIh/ LsUXbgzLk9yc86dGWHvkdgxmlmPoyfftSuoXcRcZdsSwecrM8ml4ZoLsDVZcKR0rQ3QRAM20No GoUZ7g6TIkyRF61Qq2Oq491j45+Y/X95Mj+yKbgjSsKg8DV0/bQdGEXafluQ/WqMADrlQmY5jq UR6OJWN9fXedQ0LrVH+ZZOrzfBCGid0yqX6ti3L8gLHgSYVKgEAAA== X-Change-ID: 20260501-alsa-cs35l56-system-name-leak-7fd779eac391 To: David Rhodes , Richard Fitzgerald , Takashi Iwai , Jaroslav Kysela , Simon Trimmer , Mark Brown Cc: linux-sound@vger.kernel.org, patches@opensource.cirrus.com, linux-kernel@vger.kernel.org, =?utf-8?q?C=C3=A1ssio_Gabriel?= X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=4391; i=cassiogabrielcontato@gmail.com; h=from:subject:message-id; bh=gK5vRG3AhdnrAyb29uC9wmyCZlRnTbvlVjdqCKc94bA=; b=kA0DAAoW0F0/Glr/7oMByyZiAGoPCdeiUfJq9+kVn0I3/6JjlrLXc1t+76whcEziO5bMLfEL6 Ih1BAAWCgAdFiEEq2KiObyK4NV/XqhI0F0/Glr/7oMFAmoPCdcACgkQ0F0/Glr/7oPwFQD+KaM4 tBApR8UvvWxZUyfYd3tVYBllbroa0n4VIAokbf0BAJe5/pP2IYmaW4BZRrbm8BZ1mFy7ecbUu8S HDX6A/UIK X-Developer-Key: i=cassiogabrielcontato@gmail.com; a=openpgp; fpr=AB62A239BC8AE0D57F5EA848D05D3F1A5AFFEE83 cs35l56_hda_read_acpi() gets an allocated ACPI _SUB string from acpi_get_subsystem_id(). On success, that string is used to create the firmware system name. Several error paths after the _SUB lookup can return without releasing the allocated string. This includes speaker ID lookup errors other than -ENOENT, and errors after a firmware system name has been allocated. Use scoped cleanup for the temporary _SUB string and make cs35l56->system_name device-managed. This releases the temporary _SUB string on every error path and lets devres release the firmware system name on probe failure and device removal. Fixes: 6f03b446cbae ("ALSA: hda: cs35l56: Add support for speaker id") Fixes: 40b1c2f9b299 ("ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo= Yoga Book 9i GenX") Signed-off-by: C=C3=A1ssio Gabriel --- Changes in v3: - Make cs35l56->system_name devm-managed. - Keep __free(kfree) only for the temporary ACPI _SUB string. - Remove the local cleanup-managed system_name variable. - Drop the probe-error cleanup patch; devres now owns system_name. - Remove the manual remove-time kfree for system_name. - Link to v2: https://patch.msgid.link/20260520-alsa-cs35l56-system-name-le= ak-v2-0-60f26c159023@gmail.com Changes in v2: - Use __free(kfree) for the temporary ACPI _SUB string. - Keep the derived system name local until read_acpi() succeeds. - Transfer ownership with no_free_ptr() only on successful paths. - Link to v1: https://patch.msgid.link/20260520-alsa-cs35l56-system-name-le= ak-v1-0-d13b54423198@gmail.com --- sound/hda/codecs/side-codecs/cs35l56_hda.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/sound/hda/codecs/side-codecs/cs35l56_hda.c b/sound/hda/codecs/= side-codecs/cs35l56_hda.c index cdbc576569ef..8213d62ad74b 100644 --- a/sound/hda/codecs/side-codecs/cs35l56_hda.c +++ b/sound/hda/codecs/side-codecs/cs35l56_hda.c @@ -1025,7 +1025,7 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda *= cs35l56, int hid, int id) u32 values[HDA_MAX_COMPONENTS]; char hid_string[8]; struct acpi_device *adev; - const char *property, *sub; + const char *property; int i, ret; =20 /* @@ -1047,7 +1047,8 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda *= cs35l56, int hid, int id) /* Initialize things that could be overwritten by a fixup */ cs35l56->index =3D -1; =20 - sub =3D acpi_get_subsystem_id(ACPI_HANDLE(cs35l56->base.dev)); + const char *sub __free(kfree) =3D acpi_get_subsystem_id(ACPI_HANDLE(cs35l= 56->base.dev)); + ret =3D cs35l56_hda_apply_platform_fixups(cs35l56, sub, &id); if (ret) return ret; @@ -1095,15 +1096,16 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda= *cs35l56, int hid, int id) ret =3D cirrus_scodec_get_speaker_id(cs35l56->base.dev, cs35l56->index, cs35l56->num_amps, -1); if (ret =3D=3D -ENOENT) { - cs35l56->system_name =3D sub; + cs35l56->system_name =3D devm_kstrdup(cs35l56->base.dev, sub, GFP_KERNE= L); } else if (ret >=3D 0) { - cs35l56->system_name =3D kasprintf(GFP_KERNEL, "%s-spkid%d", sub, ret); - kfree(sub); - if (!cs35l56->system_name) - return -ENOMEM; + cs35l56->system_name =3D devm_kasprintf(cs35l56->base.dev, GFP_KERNEL, + "%s-spkid%d", sub, ret); } else { return ret; } + + if (!cs35l56->system_name) + return -ENOMEM; } =20 cs35l56->base.reset_gpio =3D devm_gpiod_get_index_optional(cs35l56->base.= dev, @@ -1118,7 +1120,8 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda *= cs35l56, int hid, int id) * line and reset all the amps */ if (ret !=3D -EBUSY) - return dev_err_probe(cs35l56->base.dev, ret, "Failed to get reset GPIO\= n"); + return dev_err_probe(cs35l56->base.dev, ret, + "Failed to get reset GPIO\n"); =20 dev_info(cs35l56->base.dev, "Reset GPIO busy, assume shared reset\n"); cs35l56->base.reset_gpio =3D NULL; @@ -1254,7 +1257,6 @@ void cs35l56_hda_remove(struct device *dev) =20 cs_dsp_remove(&cs35l56->cs_dsp); =20 - kfree(cs35l56->system_name); pm_runtime_put_noidle(cs35l56->base.dev); =20 gpiod_set_value_cansleep(cs35l56->base.reset_gpio, 0); --- base-commit: 38c607c673155d6335591cdbd9c785fb2b7550e5 change-id: 20260501-alsa-cs35l56-system-name-leak-7fd779eac391 Best regards, -- =20 C=C3=A1ssio Gabriel