[PATCH] ASoC: meson: Keep link pointers valid on realloc failure

[PATCH] ASoC: meson: Keep link pointers valid on realloc failure

[Linmao Li]

meson_card_reallocate_links() grows the DAI link and private data
arrays with two consecutive krealloc() calls and updates the owner
pointers only after both calls have succeeded.

A successful krealloc() may move the data: it frees the old block and
returns a new one. When that happens for the link array and the second
krealloc() then fails, card->dai_link still points to the block that
krealloc() already freed, and the error path frees the new block too.
The probe error path then calls meson_card_clean_references(), which
dereferences card->dai_link and kfree()s it again, resulting in a
use-after-free and a double free.

Set card->dai_link right after the first krealloc() succeeds and keep
the resized array when the second call fails, so the pointer always
refers to a valid allocation that the normal cleanup path can free.
card->num_links is still updated only on full success, which keeps the
cleanup limited to initialized links.

Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
 sound/soc/meson/meson-card-utils.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
index cdb759b466ad..38c1b2ae227f 100644
--- a/sound/soc/meson/meson-card-utils.c
+++ b/sound/soc/meson/meson-card-utils.c
@@ -52,19 +52,18 @@ int meson_card_reallocate_links(struct snd_soc_card *card,
 	if (!links)
 		goto err_links;
 
+	priv->card.dai_link = links;
+
 	ldata = krealloc(priv->link_data,
 			 num_links * sizeof(*priv->link_data),
 			 GFP_KERNEL | __GFP_ZERO);
 	if (!ldata)
-		goto err_ldata;
+		goto err_links;
 
-	priv->card.dai_link = links;
 	priv->link_data = ldata;
 	priv->card.num_links = num_links;
 	return 0;
 
-err_ldata:
-	kfree(links);
 err_links:
 	dev_err(priv->card.dev, "failed to allocate links\n");
 	return -ENOMEM;

Re: [PATCH] ASoC: meson: Keep link pointers valid on realloc failure

[Jerome Brunet]

On jeu. 16 juil. 2026 at 18:09, Linmao Li <lilinmao@kylinos.cn> wrote:

> meson_card_reallocate_links() grows the DAI link and private data
> arrays with two consecutive krealloc() calls and updates the owner
> pointers only after both calls have succeeded.
>
> A successful krealloc() may move the data: it frees the old block and
> returns a new one. When that happens for the link array and the second
> krealloc() then fails, card->dai_link still points to the block that
> krealloc() already freed, and the error path frees the new block too.
> The probe error path then calls meson_card_clean_references(), which
> dereferences card->dai_link and kfree()s it again, resulting in a
> use-after-free and a double free.
>
> Set card->dai_link right after the first krealloc() succeeds and keep
> the resized array when the second call fails, so the pointer always
> refers to a valid allocation that the normal cleanup path can free.
> card->num_links is still updated only on full success, which keeps the
> cleanup limited to initialized links.
>
> Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support")
> Signed-off-by: Linmao Li <lilinmao@kylinos.cn>

Thanks for this

With this fix there is not much point in keeping the labels doing the
goto error handling. Please remove those (and the err print) and just return
-ENOMEM.

> ---
>  sound/soc/meson/meson-card-utils.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
> index cdb759b466ad..38c1b2ae227f 100644
> --- a/sound/soc/meson/meson-card-utils.c
> +++ b/sound/soc/meson/meson-card-utils.c
> @@ -52,19 +52,18 @@ int meson_card_reallocate_links(struct snd_soc_card *card,
>  	if (!links)
>  		goto err_links;
>  
> +	priv->card.dai_link = links;

You must assign num_links too for this to be consistent.

> +
>  	ldata = krealloc(priv->link_data,
>  			 num_links * sizeof(*priv->link_data),
>  			 GFP_KERNEL | __GFP_ZERO);
>  	if (!ldata)

Adding a comment here saying that meson_card_clean_references() will
take care of the above on the exist path would be helpful

> -		goto err_ldata;
> +		goto err_links;
>  
> -	priv->card.dai_link = links;
>  	priv->link_data = ldata;
>  	priv->card.num_links = num_links;
>  	return 0;
>  
> -err_ldata:
> -	kfree(links);
>  err_links:
>  	dev_err(priv->card.dev, "failed to allocate links\n");
>  	return -ENOMEM;

With this

Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>

-- 
Jerome

[PATCH v2] ASoC: meson: Keep link pointers valid on realloc failure

[Linmao Li]

meson_card_reallocate_links() grows the DAI link and private data
arrays with two consecutive krealloc() calls and updates the owner
pointers only after both calls have succeeded.

A successful krealloc() may move the data: it frees the old block and
returns a new one. When that happens for the link array and the second
krealloc() then fails, card->dai_link still points to the block that
krealloc() already freed, and the error path frees the new block too.
The probe error path then calls meson_card_clean_references(), which
dereferences card->dai_link and kfree()s it again, resulting in a
use-after-free and a double free.

Commit card->dai_link and card->num_links right after the first
krealloc() succeeds, so the pointer always refers to a valid allocation
that meson_card_clean_references() can walk and free. krealloc() with
__GFP_ZERO zero-initializes the added entries, so walking them on the
error path is safe. With both failure paths reduced to a plain return,
drop the goto labels and the error message.

Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
---
v2:
- also commit num_links together with dai_link (Jerome)
- drop the goto labels and the dev_err() (Jerome)
- comment the ldata failure path (Jerome)

 sound/soc/meson/meson-card-utils.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
index cdb759b466ad..8617a4661a33 100644
--- a/sound/soc/meson/meson-card-utils.c
+++ b/sound/soc/meson/meson-card-utils.c
@@ -50,25 +50,20 @@ int meson_card_reallocate_links(struct snd_soc_card *card,
 			 num_links * sizeof(*priv->card.dai_link),
 			 GFP_KERNEL | __GFP_ZERO);
 	if (!links)
-		goto err_links;
+		return -ENOMEM;
+
+	priv->card.dai_link = links;
+	priv->card.num_links = num_links;
 
 	ldata = krealloc(priv->link_data,
 			 num_links * sizeof(*priv->link_data),
 			 GFP_KERNEL | __GFP_ZERO);
+	/* meson_card_clean_references() will free the links on this error path */
 	if (!ldata)
-		goto err_ldata;
+		return -ENOMEM;
 
-	priv->card.dai_link = links;
 	priv->link_data = ldata;
-	priv->card.num_links = num_links;
 	return 0;
-
-err_ldata:
-	kfree(links);
-err_links:
-	dev_err(priv->card.dev, "failed to allocate links\n");
-	return -ENOMEM;
-
 }
 EXPORT_SYMBOL_GPL(meson_card_reallocate_links);
 
-- 
2.25.1

Re: [PATCH v2] ASoC: meson: Keep link pointers valid on realloc failure

[Mark Brown]

On Fri, 17 Jul 2026 09:24:33 +0800, Linmao Li wrote:
> ASoC: meson: Keep link pointers valid on realloc failure

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-7.3

Thanks!

[1/1] ASoC: meson: Keep link pointers valid on realloc failure
      https://git.kernel.org/broonie/sound/c/2aaa41cf974f

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark