From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 01A103B42FC for ; Thu, 16 Jul 2026 14:13:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784211190; cv=none; b=lPe6SdKz3rQKHjxdXNMLQUL0jFqNDInsIRJZm9UNusHYVGbGN+9B0TukLM5kJ0aw6oZtIfO93sFSUd+ZInlR7MYquPP0x2vqGUu5s+OL+LPNOGTiUm8ykuBxE81eiWoG+PoyWqMytk0jD3eth3a3WttVVqGULhs6TZ4IHbe2vUU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784211190; c=relaxed/simple; bh=mS0Ga4Pt/PLsod/JJQWij1WkU/4wsX0uUIZOw5oLu9A=; h=From:To:Cc:Subject:In-Reply-To:References:Date:Message-ID: MIME-Version:Content-Type; b=mtHkzj7ltLo0nu3YX5ZtI8FVkN/Q1f90WydiHvOO+7mjF6PNqCHOc6r8Ay3nU4ziVywLoemR3eVRiPH7tx0v2NZUq2b+G7+DUgToW+H8kblRkrAVNf4WczEAnXT0Or9AoQqJyunri9cyBGFMjluwBnC3zEZjJEw9gfe5II/n3lY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=baylibre.com; spf=pass smtp.mailfrom=baylibre.com; dkim=pass (2048-bit key) header.d=baylibre.com header.i=@baylibre.com header.b=LVVH+kF+; arc=none smtp.client-ip=209.85.128.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=baylibre.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=baylibre.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=baylibre.com header.i=@baylibre.com header.b="LVVH+kF+" Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-49545ba3d4eso1553205e9.3 for ; Thu, 16 Jul 2026 07:13:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=baylibre.com; s=google; t=1784211185; x=1784815985; darn=vger.kernel.org; h=content-type:mime-version:message-id:date:user-agent:references :in-reply-to:subject:cc:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=t/xbg5vG2nKWr3fodMKyYC2B3wNiKq/HK47SCCd7AP8=; b=LVVH+kF+kfNd4CA0Qx/qrJsBZfIPQu3wD4HMKyxvRBfa23EBJgZTwKmHObccxLlmqP oPZitTskEW16YhQUHjTNxPW4f0mJ4/FzjjkFekTRVUb+vcKjSTutASqB9BOLuMR/mqra J7s0ItkwjNBdyKSi1MniOdLCQfVPielINWWC1WwhUlg5ICvoIU8C5leKxLYcKywu6LF2 fIleKF+FvpJOprRbDPST+N6CSgTlF2pCpcYL626i2wi3I5kn6BHFf3WzGaKgVjf0lKs/ sVRMwGzfyquUMcEU4iP4R8tGbl95ok68qMRHSXOu/H/u8cvzOIvBPmhwKShdsNavxCdx Z/9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784211185; x=1784815985; h=content-type:mime-version:message-id:date:user-agent:references :in-reply-to:subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=t/xbg5vG2nKWr3fodMKyYC2B3wNiKq/HK47SCCd7AP8=; b=gAt0q5BdYvPdYd+8W2NlrvBgBkJN5eD4vCMkwnKm5Txwl02noEYYLP2X/Sz5HOQQW+ 4pWdtvomPtEoTRuQnSl6I5tX0HIAaPaSUrmU1+WZKv0u3OFNkOWVswRryfRaeS6Vs7Fu pHcYnZl6gCqHneUM76bJMKHcr2Ql7Z5xsb3QX9JhAz9bWw7N8hHSNIhuKRvCzqhizcPf cYxfJplLZA7C8Y6ytSGvghQ9egZ7waDrVfMekFLPpGo41D4m4/nfVQdOvD3rS25NxEsr bOt0kUjnrioegxgUmhw/kg3V8Tt6NsEQPB43X2fUoGOaGmevcRHUKjy4QQQDCVWIGlKa 8omg== X-Forwarded-Encrypted: i=1; AHgh+Rr7qZuOHhYAvzKD7m8/cNeeGPbTxfeZiomXUKA0oNbXal20UWeCISmXHPgY8XwmMnMH/5VwsoZKF6p3C/Q=@vger.kernel.org X-Gm-Message-State: AOJu0YyRRyQyDKqWQwps92ZP2vBez88Z8YR+TXzWx4KEu7aLxxTKvDEX Hl2/IRuv1CVmqYKAOp5VdnYSBA2usJ6FMmy7qtkLTKcSZgLZVG/ENANvLWb0ZcUhaI8= X-Gm-Gg: AfdE7cmCl2N6rtg+tmJa6myn7HIFa2kBiT1wyxyRiFfjJBea63xN15g2IWPJC3gL1ZZ UbmDjA1jK2qODgzF/9vuC6H0v0tDYq4JUcOOX0VuuKnRE3fY1x//LH10sJJDf+2fTxJ9LonAY/k 1SovtVfC5f4qDYt4CRZduYQg6l6uiaRSqC4wu0XEg4x69BoG4ltQnFE5EraFOOI/SP+tv7Duirv spdglC+7dPXpiROzppZyYodbj2awaPtYJn0NeT6xqbWQwaK9YNZ5RhYvO0Jr0NMp6KHuKdHDHDp ndIvbD44pmP+cPtWMf8/LgvWGzlrsDKaQCfgKVawr6vCLLiWWQuN2SP9MqQkWBhTwpKEcGhcXw9 9WVSPi5mHzY7ZnLgzUonBWjP+U1cc34YsoNbztmXn8nyTbQfX8CNlkjXQfaP5hz+Lo0S0hnsK2G EHUNBCpf13iiI= X-Received: by 2002:a05:600c:8509:b0:493:e451:fb8 with SMTP id 5b1f17b1804b1-49515904c4cmr154217465e9.21.1784211184975; Thu, 16 Jul 2026 07:13:04 -0700 (PDT) Received: from localhost ([2a01:e0a:3c5:5fb1:9758:7353:c342:aed3]) by smtp.gmail.com with UTF8SMTPSA id ffacd0b85a97d-47f464c1f84sm25108252f8f.29.2026.07.16.07.13.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Jul 2026 07:13:03 -0700 (PDT) From: Jerome Brunet To: Linmao Li Cc: Mark Brown , Liam Girdwood , Jaroslav Kysela , Takashi Iwai , Neil Armstrong , Kevin Hilman , Martin Blumenstingl , linux-sound@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-amlogic@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] ASoC: meson: Keep link pointers valid on realloc failure In-Reply-To: <20260716100939.1381759-1-lilinmao@kylinos.cn> (Linmao Li's message of "Thu, 16 Jul 2026 18:09:39 +0800") References: <20260716100939.1381759-1-lilinmao@kylinos.cn> User-Agent: mu4e 1.12.9; emacs 30.1 Date: Thu, 16 Jul 2026 16:13:02 +0200 Message-ID: <1jh5lzf2fl.fsf@starbuckisacylon.baylibre.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain On jeu. 16 juil. 2026 at 18:09, Linmao Li wrote: > meson_card_reallocate_links() grows the DAI link and private data > arrays with two consecutive krealloc() calls and updates the owner > pointers only after both calls have succeeded. > > A successful krealloc() may move the data: it frees the old block and > returns a new one. When that happens for the link array and the second > krealloc() then fails, card->dai_link still points to the block that > krealloc() already freed, and the error path frees the new block too. > The probe error path then calls meson_card_clean_references(), which > dereferences card->dai_link and kfree()s it again, resulting in a > use-after-free and a double free. > > Set card->dai_link right after the first krealloc() succeeds and keep > the resized array when the second call fails, so the pointer always > refers to a valid allocation that the normal cleanup path can free. > card->num_links is still updated only on full success, which keeps the > cleanup limited to initialized links. > > Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support") > Signed-off-by: Linmao Li Thanks for this With this fix there is not much point in keeping the labels doing the goto error handling. Please remove those (and the err print) and just return -ENOMEM. > --- > sound/soc/meson/meson-card-utils.c | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) > > diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c > index cdb759b466ad..38c1b2ae227f 100644 > --- a/sound/soc/meson/meson-card-utils.c > +++ b/sound/soc/meson/meson-card-utils.c > @@ -52,19 +52,18 @@ int meson_card_reallocate_links(struct snd_soc_card *card, > if (!links) > goto err_links; > > + priv->card.dai_link = links; You must assign num_links too for this to be consistent. > + > ldata = krealloc(priv->link_data, > num_links * sizeof(*priv->link_data), > GFP_KERNEL | __GFP_ZERO); > if (!ldata) Adding a comment here saying that meson_card_clean_references() will take care of the above on the exist path would be helpful > - goto err_ldata; > + goto err_links; > > - priv->card.dai_link = links; > priv->link_data = ldata; > priv->card.num_links = num_links; > return 0; > > -err_ldata: > - kfree(links); > err_links: > dev_err(priv->card.dev, "failed to allocate links\n"); > return -ENOMEM; With this Reviewed-by: Jerome Brunet -- Jerome