[PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Emanuele Ghidoli]

From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>


Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
annotated with __counted_by(num_components), so when the compiler
provides __builtin_counted_by_ref() the allocation now also sets
rtd->num_components to the number of allocated slots.

snd_soc_rtd_add_component() fills components[] one entry at a time and
expects num_components to start at zero. Starting from the allocated
size, for_each_rtd_components() stops at the first, still NULL, entry,
so the runtime has no components: they are not probed, no controls or
user-visible PCM devices are created and the card registers empty,
without any error message. In addition, each added component is stored
past the end of components[]. On the tested board these stores still
land in the slack of the kmalloc bucket that devres rounds the
allocation up to, so KASAN does not report them.

Reset num_components after the allocation.

Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
is listed in /proc/asound/cards, but /proc/asound/pcm is empty and

  amixer: Unable to find simple control 'Capture Mux',0
  aplay: main:850: audio open error: No such file or directory

Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
GCC 16.2): the failure is there without this change; with it, playback,
capture and the codec controls work again.

The root cause analysis, this change and the testing were done with the
help of an AI coding assistant (Claude Code, Claude Opus 5.5).

Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
---
4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
so this is based on v7.4-rc2.

The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
too: none of them fills a __counted_by() counter one entry at a time, so
this one looks like the only user hit by the preset counter.

 sound/soc/soc-core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 68b54e509b65..06a1d5718997 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -387,6 +387,12 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
 		device_unregister(dev);
 		return NULL;
 	}
+	/*
+	 * devm_kzalloc_flex() presets the __counted_by() counter to the
+	 * allocated size when the compiler has __builtin_counted_by_ref(),
+	 * but snd_soc_rtd_add_component() expects it to start from zero.
+	 */
+	rtd->num_components = 0;
 
 	rtd->dev = dev;
 	INIT_LIST_HEAD(&rtd->list);

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.53.0

Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Takashi Iwai]

On Mon, 09 Nov 2026 11:25:20 +0100,
Emanuele Ghidoli wrote:
On Mon, 09 Nov 2026 11:25:20 +0100,
Emanuele Ghidoli wrote:
> 
> From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> 
> 
> Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
> devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
> in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
> annotated with __counted_by(num_components), so when the compiler
> provides __builtin_counted_by_ref() the allocation now also sets
> rtd->num_components to the number of allocated slots.
> 
> snd_soc_rtd_add_component() fills components[] one entry at a time and
> expects num_components to start at zero. Starting from the allocated
> size, for_each_rtd_components() stops at the first, still NULL, entry,
> so the runtime has no components: they are not probed, no controls or
> user-visible PCM devices are created and the card registers empty,
> without any error message. In addition, each added component is stored
> past the end of components[]. On the tested board these stores still
> land in the slack of the kmalloc bucket that devres rounds the
> allocation up to, so KASAN does not report them.
> 
> Reset num_components after the allocation.
> 
> Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
> is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
> 
>   amixer: Unable to find simple control 'Capture Mux',0
>   aplay: main:850: audio open error: No such file or directory
> 
> Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
> GCC 16.2): the failure is there without this change; with it, playback,
> capture and the codec controls work again.
> 
> The root cause analysis, this change and the testing were done with the
> help of an AI coding assistant (Claude Code, Claude Opus 5.5).
> 
> Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> ---
> 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
> so this is based on v7.4-rc2.
> 
> The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
> too: none of them fills a __counted_by() counter one entry at a time, so
> this one looks like the only user hit by the preset counter.

I guess a bugzilla entry that was reported recently is also related
with this problem.
  https://bugzilla.kernel.org/show_bug.cgi?id=222249

My first gut feeling was that it might be safer to revert the use of
devm_kmalloc_flex() in that code, as it has a significant side-effect
unlike other straight conversions.  But, if this fix covers well, we
can go with this fix, of course.


thanks,

Takashi


> 
>  sound/soc/soc-core.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
> index 68b54e509b65..06a1d5718997 100644
> --- a/sound/soc/soc-core.c
> +++ b/sound/soc/soc-core.c
> @@ -387,6 +387,12 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
>  		device_unregister(dev);
>  		return NULL;
>  	}
> +	/*
> +	 * devm_kzalloc_flex() presets the __counted_by() counter to the
> +	 * allocated size when the compiler has __builtin_counted_by_ref(),
> +	 * but snd_soc_rtd_add_component() expects it to start from zero.
> +	 */
> +	rtd->num_components = 0;
>  
>  	rtd->dev = dev;
>  	INIT_LIST_HEAD(&rtd->list);
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> -- 
> 2.53.0
> 
> 
> From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> 
> 
> Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
> devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
> in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
> annotated with __counted_by(num_components), so when the compiler
> provides __builtin_counted_by_ref() the allocation now also sets
> rtd->num_components to the number of allocated slots.
> 
> snd_soc_rtd_add_component() fills components[] one entry at a time and
> expects num_components to start at zero. Starting from the allocated
> size, for_each_rtd_components() stops at the first, still NULL, entry,
> so the runtime has no components: they are not probed, no controls or
> user-visible PCM devices are created and the card registers empty,
> without any error message. In addition, each added component is stored
> past the end of components[]. On the tested board these stores still
> land in the slack of the kmalloc bucket that devres rounds the
> allocation up to, so KASAN does not report them.
> 
> Reset num_components after the allocation.
> 
> Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
> is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
> 
>   amixer: Unable to find simple control 'Capture Mux',0
>   aplay: main:850: audio open error: No such file or directory
> 
> Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
> GCC 16.2): the failure is there without this change; with it, playback,
> capture and the codec controls work again.
> 
> The root cause analysis, this change and the testing were done with the
> help of an AI coding assistant (Claude Code, Claude Opus 5.5).
> 
> Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> ---
> 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
> so this is based on v7.4-rc2.
> 
> The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
> too: none of them fills a __counted_by() counter one entry at a time, so
> this one looks like the only user hit by the preset counter.
> 
>  sound/soc/soc-core.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
> index 68b54e509b65..06a1d5718997 100644
> --- a/sound/soc/soc-core.c
> +++ b/sound/soc/soc-core.c
> @@ -387,6 +387,12 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
>  		device_unregister(dev);
>  		return NULL;
>  	}
> +	/*
> +	 * devm_kzalloc_flex() presets the __counted_by() counter to the
> +	 * allocated size when the compiler has __builtin_counted_by_ref(),
> +	 * but snd_soc_rtd_add_component() expects it to start from zero.
> +	 */
> +	rtd->num_components = 0;
>  
>  	rtd->dev = dev;
>  	INIT_LIST_HEAD(&rtd->list);
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> -- 
> 2.53.0
> 

Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Jan Remes]

On Mon, 09 Nov 2026 11:25:20 +0100, Emanuele Ghidoli wrote:
> Reset num_components after the allocation.

The same regression hits Intel SOF/HDA: on a ThinkPad E16 Gen3 (Arrow
Lake, Core Ultra 7 255H, Conexant SN6140) no internal card is registered
on v7.4-rc2, with

  skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: Failed to add route ...
  Analog Playback and Capture: fail to add hda routes, ret -19

This also looks like the regression reported for Meteor Lake here:
https://lore.kernel.org/all/mAZY9HZuXAXUf7zv8tqXquMtquf7iW2CIZB7WhU-SnwWp-Rpr0e8yixTsb3lAeQsO64PwwWlOao8aMjQ4hTKOQ6grCiNmaWZmFRXMdPICD8=@proton.me/

With this patch on top of v7.4-rc2 the card is registered again: the
topology loads, and speaker, mics and HDMI outputs are back, with no
warnings in the log.

Tested-by: Jan Remes <ciakval@gmail.com>

Best regards,
  Jan

Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Takashi Iwai]

On Mon, 09 Nov 2026 12:07:33 +0100,
Takashi Iwai wrote:
> 
> On Mon, 09 Nov 2026 11:25:20 +0100,
> Emanuele Ghidoli wrote:
> On Mon, 09 Nov 2026 11:25:20 +0100,
> Emanuele Ghidoli wrote:
> > 
> > From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> > 
> > 
> > Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
> > devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
> > in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
> > annotated with __counted_by(num_components), so when the compiler
> > provides __builtin_counted_by_ref() the allocation now also sets
> > rtd->num_components to the number of allocated slots.
> > 
> > snd_soc_rtd_add_component() fills components[] one entry at a time and
> > expects num_components to start at zero. Starting from the allocated
> > size, for_each_rtd_components() stops at the first, still NULL, entry,
> > so the runtime has no components: they are not probed, no controls or
> > user-visible PCM devices are created and the card registers empty,
> > without any error message. In addition, each added component is stored
> > past the end of components[]. On the tested board these stores still
> > land in the slack of the kmalloc bucket that devres rounds the
> > allocation up to, so KASAN does not report them.
> > 
> > Reset num_components after the allocation.
> > 
> > Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
> > is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
> > 
> >   amixer: Unable to find simple control 'Capture Mux',0
> >   aplay: main:850: audio open error: No such file or directory
> > 
> > Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
> > GCC 16.2): the failure is there without this change; with it, playback,
> > capture and the codec controls work again.
> > 
> > The root cause analysis, this change and the testing were done with the
> > help of an AI coding assistant (Claude Code, Claude Opus 5.5).
> > 
> > Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
> > Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> > ---
> > 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
> > so this is based on v7.4-rc2.
> > 
> > The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
> > too: none of them fills a __counted_by() counter one entry at a time, so
> > this one looks like the only user hit by the preset counter.
> 
> I guess a bugzilla entry that was reported recently is also related
> with this problem.
>   https://bugzilla.kernel.org/show_bug.cgi?id=222249
> 
> My first gut feeling was that it might be safer to revert the use of
> devm_kmalloc_flex() in that code, as it has a significant side-effect
> unlike other straight conversions.  But, if this fix covers well, we
> can go with this fix, of course.

And it seems working for the bugzilla issue above, too.

Mark, could you pick this up quickly?  It looks like a severe
regression.

Reviewed-by: Takashi Iwai <tiwai@suse.de>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=222249


thanks,

Takashi

Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Kees Cook]

On November 9, 2026 3:07:33 AM PST, Takashi Iwai <tiwai@suse.de> wrote:
>On Mon, 09 Nov 2026 11:25:20 +0100,
>Emanuele Ghidoli wrote:
>On Mon, 09 Nov 2026 11:25:20 +0100,
>Emanuele Ghidoli wrote:
>> 
>> From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
>> 
>> 
>> Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
>> devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
>> in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
>> annotated with __counted_by(num_components), so when the compiler
>> provides __builtin_counted_by_ref() the allocation now also sets
>> rtd->num_components to the number of allocated slots.
>> 
>> snd_soc_rtd_add_component() fills components[] one entry at a time and
>> expects num_components to start at zero. Starting from the allocated
>> size, for_each_rtd_components() stops at the first, still NULL, entry,
>> so the runtime has no components: they are not probed, no controls or
>> user-visible PCM devices are created and the card registers empty,
>> without any error message. In addition, each added component is stored
>> past the end of components[]. On the tested board these stores still
>> land in the slack of the kmalloc bucket that devres rounds the
>> allocation up to, so KASAN does not report them.
>> 
>> Reset num_components after the allocation.
>> 
>> Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
>> is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
>> 
>>   amixer: Unable to find simple control 'Capture Mux',0
>>   aplay: main:850: audio open error: No such file or directory
>> 
>> Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
>> GCC 16.2): the failure is there without this change; with it, playback,
>> capture and the codec controls work again.
>> 
>> The root cause analysis, this change and the testing were done with the
>> help of an AI coding assistant (Claude Code, Claude Opus 5.5).
>> 
>> Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
>> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
>> ---
>> 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
>> so this is based on v7.4-rc2.
>> 
>> The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
>> too: none of them fills a __counted_by() counter one entry at a time, so
>> this one looks like the only user hit by the preset counter.

Aggh, sorry for the problem, and thanks for checking the other cases.

>
>I guess a bugzilla entry that was reported recently is also related
>with this problem.
>  https://bugzilla.kernel.org/show_bug.cgi?id=222249
>
>My first gut feeling was that it might be safer to revert the use of
>devm_kmalloc_flex() in that code, as it has a significant side-effect
>unlike other straight conversions.  But, if this fix covers well, we
>can go with this fix, of course.

The problem is the annotation, IMO, as the counter member doesn't track allocation size, it tracks usage.


-- 
Kees Cook

Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Kees Cook]

On November 10, 2026 9:50:08 PM PST, Kees Cook <kees@kernel.org> wrote:
>
>
>On November 9, 2026 3:07:33 AM PST, Takashi Iwai <tiwai@suse.de> wrote:
>>On Mon, 09 Nov 2026 11:25:20 +0100,
>>Emanuele Ghidoli wrote:
>>On Mon, 09 Nov 2026 11:25:20 +0100,
>>Emanuele Ghidoli wrote:
>>> 
>>> From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
>>> 
>>> 
>>> Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
>>> devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
>>> in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
>>> annotated with __counted_by(num_components), so when the compiler
>>> provides __builtin_counted_by_ref() the allocation now also sets
>>> rtd->num_components to the number of allocated slots.
>>> 
>>> snd_soc_rtd_add_component() fills components[] one entry at a time and
>>> expects num_components to start at zero. Starting from the allocated
>>> size, for_each_rtd_components() stops at the first, still NULL, entry,
>>> so the runtime has no components: they are not probed, no controls or
>>> user-visible PCM devices are created and the card registers empty,
>>> without any error message. In addition, each added component is stored
>>> past the end of components[]. On the tested board these stores still
>>> land in the slack of the kmalloc bucket that devres rounds the
>>> allocation up to, so KASAN does not report them.
>>> 
>>> Reset num_components after the allocation.
>>> 
>>> Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
>>> is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
>>> 
>>>   amixer: Unable to find simple control 'Capture Mux',0
>>>   aplay: main:850: audio open error: No such file or directory
>>> 
>>> Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
>>> GCC 16.2): the failure is there without this change; with it, playback,
>>> capture and the codec controls work again.
>>> 
>>> The root cause analysis, this change and the testing were done with the
>>> help of an AI coding assistant (Claude Code, Claude Opus 5.5).
>>> 
>>> Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
>>> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
>>> ---
>>> 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
>>> so this is based on v7.4-rc2.
>>> 
>>> The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
>>> too: none of them fills a __counted_by() counter one entry at a time, so
>>> this one looks like the only user hit by the preset counter.
>
>Aggh, sorry for the problem, and thanks for checking the other cases.
>
>>
>>I guess a bugzilla entry that was reported recently is also related
>>with this problem.
>>  https://bugzilla.kernel.org/show_bug.cgi?id=222249
>>
>>My first gut feeling was that it might be safer to revert the use of
>>devm_kmalloc_flex() in that code, as it has a significant side-effect
>>unlike other straight conversions.  But, if this fix covers well, we
>>can go with this fix, of course.
>
>The problem is the annotation, IMO, as the counter member doesn't track allocation size, it tracks usage.

For example, what keeps snd_soc_rtd_add_component() from overflowing that array? If you want to protect the array, add another member, say max_component, and use that for the counter, which gets set at allocation time and protects the array from indexing beyond the actual allocation size.


-- 
Kees Cook

Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Alexander Stein]

Hi,

thanks for the patch.

Am Montag, 9. November 2026, 11:25:20 Mitteleuropäische Normalzeit schrieb Emanuele Ghidoli:
> From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> 
> 
> Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
> devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
> in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
> annotated with __counted_by(num_components), so when the compiler
> provides __builtin_counted_by_ref() the allocation now also sets
> rtd->num_components to the number of allocated slots.
> 
> snd_soc_rtd_add_component() fills components[] one entry at a time and
> expects num_components to start at zero. Starting from the allocated
> size, for_each_rtd_components() stops at the first, still NULL, entry,
> so the runtime has no components: they are not probed, no controls or
> user-visible PCM devices are created and the card registers empty,
> without any error message. In addition, each added component is stored
> past the end of components[]. On the tested board these stores still
> land in the slack of the kmalloc bucket that devres rounds the
> allocation up to, so KASAN does not report them.
> 
> Reset num_components after the allocation.
> 
> Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
> is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
> 
>   amixer: Unable to find simple control 'Capture Mux',0
>   aplay: main:850: audio open error: No such file or directory
> 
> Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
> GCC 16.2): the failure is there without this change; with it, playback,
> capture and the codec controls work again.
> 
> The root cause analysis, this change and the testing were done with the
> help of an AI coding assistant (Claude Code, Claude Opus 5.5).
> 
> Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>

This fixes TQMa8MPxL/MBa8MPxL as well which is also affected by commit
4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
devm_kmalloc_obj() family").
FWIW:
Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>

> ---
> 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
> so this is based on v7.4-rc2.
> 
> The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
> too: none of them fills a __counted_by() counter one entry at a time, so
> this one looks like the only user hit by the preset counter.
> 
>  sound/soc/soc-core.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
> index 68b54e509b65..06a1d5718997 100644
> --- a/sound/soc/soc-core.c
> +++ b/sound/soc/soc-core.c
> @@ -387,6 +387,12 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
>  		device_unregister(dev);
>  		return NULL;
>  	}
> +	/*
> +	 * devm_kzalloc_flex() presets the __counted_by() counter to the
> +	 * allocated size when the compiler has __builtin_counted_by_ref(),
> +	 * but snd_soc_rtd_add_component() expects it to start from zero.
> +	 */
> +	rtd->num_components = 0;
>  
>  	rtd->dev = dev;
>  	INIT_LIST_HEAD(&rtd->list);
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> 


-- 
TQ-Systems GmbH | Mühlstraße 2, Gut Delling | 82229 Seefeld, Germany
Amtsgericht München, HRB 105018
Geschäftsführer: Detlef Schneider, Rüdiger Stahl, Stefan Schneider
http://www.tq-group.com/

Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Emanuele Ghidoli]

On 11/11/26 06:59, Kees Cook wrote:
> 
> 
> On November 10, 2026 9:50:08 PM PST, Kees Cook <kees@kernel.org> wrote:
> 
> For example, what keeps snd_soc_rtd_add_component() from overflowing that array? If you want to protect the array, add another member, say max_component, and use that for the counter, which gets set at allocation time and protects the array from indexing beyond the actual allocation size.
> 
> 

Hello Kees,

Mark has already applied the fix to for-7.4 (d00ba321499c). I agree that
your proposal is far better, but the applied patch was meant as the
minimal change to fix the regression.

On your question about what keeps snd_soc_rtd_add_component() from
overflowing the array: nothing, and it already seems possible today.

From an LLM-assisted review of the code: the platform loop in
snd_soc_add_pcm_runtime() adds every component that matches the platform
dai_link_component, while components[] has one entry per
platform. On mt8173, for example, the AFE registers three components on the
same device and the front-end links use it as platform, so four components go
into three entries. The extra store has gone unnoticed in the slab slack, but
with max_components as the counter UBSAN_BOUNDS would report it.

I can't work on a follow-up. If someone picks it up, components[] probably
needs to be sized by the matching components before the counter is switched to
max_components.

Emanuele

Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Rujbin]

Hi Emanuele,

Thanks for the fix!

I tested the same one-line change on my ThinkPad L16 Gen 1 (Meteor Lake-P, Conexant SN6140) running Linux v7.4-rc2.

With the patched snd-soc-core.ko, all 18 ASoC route errors disappeared, and the sof-hda-dsp sound card was registered successfully.

Tested-by: Rujbin Nassereslam rujbin@proton.me

Thanks,
Rujbin