mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* [PATCH] ASoC: soc-core: start the runtime's component count at zero
@ 2026-11-11  1:18 Ryan Brue
  2026-11-11  3:07 ` Ryan Brue
  0 siblings, 1 reply; 2+ messages in thread
From: Ryan Brue @ 2026-11-11  1:18 UTC (permalink / raw)
  To: Liam Girdwood, Mark Brown, Jaroslav Kysela, Takashi Iwai,
	Kees Cook, Gustavo A. R. Silva
  Cc: Kees Cook, linux-sound, linux-kernel, linux-hardening, Ryan Brue

Since commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to
the devm_kmalloc_obj() family"), soc_new_pcm_runtime() allocates the
runtime with devm_kzalloc_flex(). Since components[] is
__counted_by(num_components), that also sets num_components to the array's
capacity, but snd_soc_rtd_add_component() treats num_components as the
number of components added so far and appends after it.

Every component is therefore written past the end of the allocation, and
for_each_rtd_components() stops at the first, still NULL, entry, so a
link's components are never found. On an MT8173 board the RT5514 link's
init can no longer route to the codec's AMICL widget and the card fails
to register:

  mt8173-mt6391 sound: ASoC: Failed to add route Int Mic -> AMICL(*)
  RT5514 Codec: ASoC error (-19): at snd_soc_link_init() on RT5514 Codec

Reset the count after the allocation.

Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
Signed-off-by: Ryan Brue <ryanbrue.dev@gmail.com>
---
Since v7.4-rc2, every ASoC card writes its runtimes' components past the
end of their allocation, because devm_kzalloc_flex() now sets the
__counted_by counter that snd_soc_rtd_add_component() expects to start at
zero. On an MT8173 tablet (amazon-suez) this left the card unregistered.
This fix brings it back.

This patch was developed with the help of an LLM.
---
 sound/soc/soc-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 68b54e509b65..7b3d980ef10d 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -388,6 +388,8 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
 		return NULL;
 	}
 
+	rtd->num_components = 0;
+
 	rtd->dev = dev;
 	INIT_LIST_HEAD(&rtd->list);
 	for_each_pcm_streams(stream) {

---
base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
change-id: 20261110-rbrue-asoc-rtd-num-components-93a1b188469e

Best regards,
-- 
Ryan Brue <ryanbrue.dev@gmail.com>


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] ASoC: soc-core: start the runtime's component count at zero
  2026-11-11  1:18 [PATCH] ASoC: soc-core: start the runtime's component count at zero Ryan Brue
@ 2026-11-11  3:07 ` Ryan Brue
  0 siblings, 0 replies; 2+ messages in thread
From: Ryan Brue @ 2026-11-11  3:07 UTC (permalink / raw)
  To: Liam Girdwood, Mark Brown, Jaroslav Kysela, Takashi Iwai,
	Kees Cook, Gustavo A. R. Silva
  Cc: Kees Cook, linux-sound, linux-kernel, linux-hardening

On 11/10/26 7:18 PM, Ryan Brue wrote:
> Since commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to
> the devm_kmalloc_obj() family"), soc_new_pcm_runtime() allocates the
> runtime with devm_kzalloc_flex(). Since components[] is
> __counted_by(num_components), that also sets num_components to the array's
> capacity, but snd_soc_rtd_add_component() treats num_components as the
> number of components added so far and appends after it.
>
> Every component is therefore written past the end of the allocation, and
> for_each_rtd_components() stops at the first, still NULL, entry, so a
> link's components are never found. On an MT8173 board the RT5514 link's
> init can no longer route to the codec's AMICL widget and the card fails
> to register:
>
>    mt8173-mt6391 sound: ASoC: Failed to add route Int Mic -> AMICL(*)
>    RT5514 Codec: ASoC error (-19): at snd_soc_link_init() on RT5514 Codec
>
> Reset the count after the allocation.

Please disregard this, I didn't see Emanuele's fix for the same bug in 
for-7.4 as d00ba321499c ("ASoC: soc-core: reset rtd->num_components 
after allocation").

Apologies,
Ryan

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2026-11-11  3:07 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-11  1:18 [PATCH] ASoC: soc-core: start the runtime's component count at zero Ryan Brue
2026-11-11  3:07 ` Ryan Brue

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®