[PATCH] ASoC: meson: Keep link pointers valid on realloc failure

[PATCH] ASoC: meson: Keep link pointers valid on realloc failure

[Linmao Li]

meson_card_reallocate_links() grows the DAI link and private data
arrays with two consecutive krealloc() calls and updates the owner
pointers only after both calls have succeeded.

A successful krealloc() may move the data: it frees the old block and
returns a new one. When that happens for the link array and the second
krealloc() then fails, card->dai_link still points to the block that
krealloc() already freed, and the error path frees the new block too.
The probe error path then calls meson_card_clean_references(), which
dereferences card->dai_link and kfree()s it again, resulting in a
use-after-free and a double free.

Set card->dai_link right after the first krealloc() succeeds and keep
the resized array when the second call fails, so the pointer always
refers to a valid allocation that the normal cleanup path can free.
card->num_links is still updated only on full success, which keeps the
cleanup limited to initialized links.

Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
 sound/soc/meson/meson-card-utils.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
index cdb759b466ad..38c1b2ae227f 100644
--- a/sound/soc/meson/meson-card-utils.c
+++ b/sound/soc/meson/meson-card-utils.c
@@ -52,19 +52,18 @@ int meson_card_reallocate_links(struct snd_soc_card *card,
 	if (!links)
 		goto err_links;
 
+	priv->card.dai_link = links;
+
 	ldata = krealloc(priv->link_data,
 			 num_links * sizeof(*priv->link_data),
 			 GFP_KERNEL | __GFP_ZERO);
 	if (!ldata)
-		goto err_ldata;
+		goto err_links;
 
-	priv->card.dai_link = links;
 	priv->link_data = ldata;
 	priv->card.num_links = num_links;
 	return 0;
 
-err_ldata:
-	kfree(links);
 err_links:
 	dev_err(priv->card.dev, "failed to allocate links\n");
 	return -ENOMEM;

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

Re: [PATCH] ASoC: meson: Keep link pointers valid on realloc failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unbinding the device causes a use-after-free because `meson_card_remove` frees `card->dai_link` manually before the devres callbacks unregister the card.
--

--- Patch [1]: [PATCH] ASoC: meson: Keep link pointers valid on realloc failure ---
commit 677ad75f5fb5a578b984e744f26d24b961c89685
Author: Linmao Li <lilinmao@kylinos.cn>

ASoC: meson: Keep link pointers valid on realloc failure

This commit fixes a potential use-after-free and double free in the error
path of meson_card_reallocate_links(). It updates the card->dai_link
pointer immediately after the first successful krealloc(), ensuring the
cleanup path can safely free the memory if the second krealloc() fails.

> diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
> index cdb759b466ad4..38c1b2ae227ff 100644
> --- a/sound/soc/meson/meson-card-utils.c
> +++ b/sound/soc/meson/meson-card-utils.c
> @@ -52,19 +52,18 @@ int meson_card_reallocate_links(struct snd_soc_card *card,
>  	if (!links)
>  		goto err_links;
>  
> +	priv->card.dai_link = links;
> +
>  	ldata = krealloc(priv->link_data,
>  			 num_links * sizeof(*priv->link_data),
>  			 GFP_KERNEL | __GFP_ZERO);
>  	if (!ldata)
> -		goto err_ldata;
> +		goto err_links;
>  
> -	priv->card.dai_link = links;
>  	priv->link_data = ldata;
>  	priv->card.num_links = num_links;
>  	return 0;
>  
> -err_ldata:
> -	kfree(links);
>  err_links:
>  	dev_err(priv->card.dev, "failed to allocate links\n");
>  	return -ENOMEM;

[Severity: High]
This isn't a bug introduced by this patch, but does unbinding the device
cause a use-after-free because meson_card_remove() frees card->dai_link
manually before the devres callbacks unregister the card?

When the driver is unbound, the driver core calls meson_card_remove(), which
calls meson_card_clean_references() to free the links:

sound/soc/meson/meson-card-utils.c:meson_card_clean_references() {
    ...
    kfree(card->dai_link);
    ...
}

Only after .remove returns does the driver core run devres callbacks, which
includes unregistering the card via devm_snd_soc_register_card's cleanup
handler.

The ASoC unregister path iterates over all PCM runtimes and dereferences
rtd->dai_link, which points directly to elements of the already freed
card->dai_link array.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716100939.1381759-1-lilinmao@kylinos.cn?part=1

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

Re: [PATCH] ASoC: meson: Keep link pointers valid on realloc failure

[Jerome Brunet]

On jeu. 16 juil. 2026 at 18:09, Linmao Li <lilinmao@kylinos.cn> wrote:

> meson_card_reallocate_links() grows the DAI link and private data
> arrays with two consecutive krealloc() calls and updates the owner
> pointers only after both calls have succeeded.
>
> A successful krealloc() may move the data: it frees the old block and
> returns a new one. When that happens for the link array and the second
> krealloc() then fails, card->dai_link still points to the block that
> krealloc() already freed, and the error path frees the new block too.
> The probe error path then calls meson_card_clean_references(), which
> dereferences card->dai_link and kfree()s it again, resulting in a
> use-after-free and a double free.
>
> Set card->dai_link right after the first krealloc() succeeds and keep
> the resized array when the second call fails, so the pointer always
> refers to a valid allocation that the normal cleanup path can free.
> card->num_links is still updated only on full success, which keeps the
> cleanup limited to initialized links.
>
> Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support")
> Signed-off-by: Linmao Li <lilinmao@kylinos.cn>

Thanks for this

With this fix there is not much point in keeping the labels doing the
goto error handling. Please remove those (and the err print) and just return
-ENOMEM.

> ---
>  sound/soc/meson/meson-card-utils.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
> index cdb759b466ad..38c1b2ae227f 100644
> --- a/sound/soc/meson/meson-card-utils.c
> +++ b/sound/soc/meson/meson-card-utils.c
> @@ -52,19 +52,18 @@ int meson_card_reallocate_links(struct snd_soc_card *card,
>  	if (!links)
>  		goto err_links;
>  
> +	priv->card.dai_link = links;

You must assign num_links too for this to be consistent.

> +
>  	ldata = krealloc(priv->link_data,
>  			 num_links * sizeof(*priv->link_data),
>  			 GFP_KERNEL | __GFP_ZERO);
>  	if (!ldata)

Adding a comment here saying that meson_card_clean_references() will
take care of the above on the exist path would be helpful

> -		goto err_ldata;
> +		goto err_links;
>  
> -	priv->card.dai_link = links;
>  	priv->link_data = ldata;
>  	priv->card.num_links = num_links;
>  	return 0;
>  
> -err_ldata:
> -	kfree(links);
>  err_links:
>  	dev_err(priv->card.dev, "failed to allocate links\n");
>  	return -ENOMEM;

With this

Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>

-- 
Jerome

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

Re: [PATCH] ASoC: meson: Keep link pointers valid on realloc failure

[Jerome Brunet]

On jeu. 16 juil. 2026 at 10:25, sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] Unbinding the device causes a use-after-free because `meson_card_remove` frees `card->dai_link` manually before the devres callbacks unregister the card.
> --
>
> --- Patch [1]: [PATCH] ASoC: meson: Keep link pointers valid on realloc failure ---
> commit 677ad75f5fb5a578b984e744f26d24b961c89685
> Author: Linmao Li <lilinmao@kylinos.cn>
>
> ASoC: meson: Keep link pointers valid on realloc failure
>
> This commit fixes a potential use-after-free and double free in the error
> path of meson_card_reallocate_links(). It updates the card->dai_link
> pointer immediately after the first successful krealloc(), ensuring the
> cleanup path can safely free the memory if the second krealloc() fails.
>
>> diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
>> index cdb759b466ad4..38c1b2ae227ff 100644
>> --- a/sound/soc/meson/meson-card-utils.c
>> +++ b/sound/soc/meson/meson-card-utils.c
>> @@ -52,19 +52,18 @@ int meson_card_reallocate_links(struct snd_soc_card *card,
>>  	if (!links)
>>  		goto err_links;
>>  
>> +	priv->card.dai_link = links;
>> +
>>  	ldata = krealloc(priv->link_data,
>>  			 num_links * sizeof(*priv->link_data),
>>  			 GFP_KERNEL | __GFP_ZERO);
>>  	if (!ldata)
>> -		goto err_ldata;
>> +		goto err_links;
>>  
>> -	priv->card.dai_link = links;
>>  	priv->link_data = ldata;
>>  	priv->card.num_links = num_links;
>>  	return 0;
>>  
>> -err_ldata:
>> -	kfree(links);
>>  err_links:
>>  	dev_err(priv->card.dev, "failed to allocate links\n");
>>  	return -ENOMEM;
>
> [Severity: High]
> This isn't a bug introduced by this patch, but does unbinding the device
> cause a use-after-free because meson_card_remove() frees card->dai_link
> manually before the devres callbacks unregister the card?
>
> When the driver is unbound, the driver core calls meson_card_remove(), which
> calls meson_card_clean_references() to free the links:
>
> sound/soc/meson/meson-card-utils.c:meson_card_clean_references() {
>     ...
>     kfree(card->dai_link);
>     ...
> }
>
> Only after .remove returns does the driver core run devres callbacks, which
> includes unregistering the card via devm_snd_soc_register_card's cleanup
> handler.
>
> The ASoC unregister path iterates over all PCM runtimes and dereferences
> rtd->dai_link, which points directly to elements of the already freed
> card->dai_link array.

Indeed. We need to move away from devres card registration to deregister
the card before freeing the rest in the ressource clean up. I'll do so
as soon as we have the v2 of this change.

-- 
Jerome

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

[PATCH v2] ASoC: meson: Keep link pointers valid on realloc failure

[Linmao Li]

meson_card_reallocate_links() grows the DAI link and private data
arrays with two consecutive krealloc() calls and updates the owner
pointers only after both calls have succeeded.

A successful krealloc() may move the data: it frees the old block and
returns a new one. When that happens for the link array and the second
krealloc() then fails, card->dai_link still points to the block that
krealloc() already freed, and the error path frees the new block too.
The probe error path then calls meson_card_clean_references(), which
dereferences card->dai_link and kfree()s it again, resulting in a
use-after-free and a double free.

Commit card->dai_link and card->num_links right after the first
krealloc() succeeds, so the pointer always refers to a valid allocation
that meson_card_clean_references() can walk and free. krealloc() with
__GFP_ZERO zero-initializes the added entries, so walking them on the
error path is safe. With both failure paths reduced to a plain return,
drop the goto labels and the error message.

Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
---
v2:
- also commit num_links together with dai_link (Jerome)
- drop the goto labels and the dev_err() (Jerome)
- comment the ldata failure path (Jerome)

 sound/soc/meson/meson-card-utils.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
index cdb759b466ad..8617a4661a33 100644
--- a/sound/soc/meson/meson-card-utils.c
+++ b/sound/soc/meson/meson-card-utils.c
@@ -50,25 +50,20 @@ int meson_card_reallocate_links(struct snd_soc_card *card,
 			 num_links * sizeof(*priv->card.dai_link),
 			 GFP_KERNEL | __GFP_ZERO);
 	if (!links)
-		goto err_links;
+		return -ENOMEM;
+
+	priv->card.dai_link = links;
+	priv->card.num_links = num_links;
 
 	ldata = krealloc(priv->link_data,
 			 num_links * sizeof(*priv->link_data),
 			 GFP_KERNEL | __GFP_ZERO);
+	/* meson_card_clean_references() will free the links on this error path */
 	if (!ldata)
-		goto err_ldata;
+		return -ENOMEM;
 
-	priv->card.dai_link = links;
 	priv->link_data = ldata;
-	priv->card.num_links = num_links;
 	return 0;
-
-err_ldata:
-	kfree(links);
-err_links:
-	dev_err(priv->card.dev, "failed to allocate links\n");
-	return -ENOMEM;
-
 }
 EXPORT_SYMBOL_GPL(meson_card_reallocate_links);
 
-- 
2.25.1


_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic