[PATCH] ASoC: qdsp6: q6routing: Fix memory leak on probe failure

[PATCH] ASoC: qdsp6: q6routing: Fix memory leak on probe failure

[Tang Bin]

routing_data is allocated with kzalloc() (not devm_kzalloc) and stored
in a global static pointer. If devm_snd_soc_register_component() fails,
the probe function returns the error directly without freeing
routing_data. Since the remove callback is not invoked on probe failure,
the allocated memory is leaked.

On a probe retry, a new routing_data would be allocated, overwriting
the global pointer and losing the reference to the previous allocation.

Fix this by checking the return value of
devm_snd_soc_register_component() and freeing routing_data on failure.

Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver")
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
---
 sound/soc/qcom/qdsp6/q6routing.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
index d076c99f1..fb633efd8 100644
--- a/sound/soc/qcom/qdsp6/q6routing.c
+++ b/sound/soc/qcom/qdsp6/q6routing.c
@@ -1208,6 +1208,7 @@ static const struct snd_soc_component_driver msm_soc_routing_component = {
 static int q6pcm_routing_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
+	int ret;
 
 	routing_data = kzalloc_obj(*routing_data);
 	if (!routing_data)
@@ -1218,8 +1219,13 @@ static int q6pcm_routing_probe(struct platform_device *pdev)
 	mutex_init(&routing_data->lock);
 	dev_set_drvdata(dev, routing_data);
 
-	return devm_snd_soc_register_component(dev, &msm_soc_routing_component,
+	ret = devm_snd_soc_register_component(dev, &msm_soc_routing_component,
 					  NULL, 0);
+	if (ret) {
+		kfree(routing_data);
+		routing_data = NULL;
+	}
+	return ret;
 }
 
 static void q6pcm_routing_remove(struct platform_device *pdev)
-- 
2.52.0.windows.1

Re: [PATCH] ASoC: qdsp6: q6routing: Fix memory leak on probe failure

[Srinivas Kandagatla]

On 10/25/26 8:02 AM, Tang Bin wrote:
> routing_data is allocated with kzalloc() (not devm_kzalloc) and stored
> in a global static pointer. If devm_snd_soc_register_component() fails,
> the probe function returns the error directly without freeing
> routing_data. Since the remove callback is not invoked on probe failure,
> the allocated memory is leaked.
> 
> On a probe retry, a new routing_data would be allocated, overwriting
> the global pointer and losing the reference to the previous allocation.
> 
> Fix this by checking the return value of
> devm_snd_soc_register_component() and freeing routing_data on failure.
> 
> Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver")
> Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
> ---
>  sound/soc/qcom/qdsp6/q6routing.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
> index d076c99f1..fb633efd8 100644
> --- a/sound/soc/qcom/qdsp6/q6routing.c
> +++ b/sound/soc/qcom/qdsp6/q6routing.c
> @@ -1208,6 +1208,7 @@ static const struct snd_soc_component_driver msm_soc_routing_component = {
>  static int q6pcm_routing_probe(struct platform_device *pdev)
>  {
>  	struct device *dev = &pdev->dev;
> +	int ret;
>  
>  	routing_data = kzalloc_obj(*routing_data);
>  	if (!routing_data)
> @@ -1218,8 +1219,13 @@ static int q6pcm_routing_probe(struct platform_device *pdev)
>  	mutex_init(&routing_data->lock);
>  	dev_set_drvdata(dev, routing_data);
>  
> -	return devm_snd_soc_register_component(dev, &msm_soc_routing_component,
> +	ret = devm_snd_soc_register_component(dev, &msm_soc_routing_component,
>  					  NULL, 0);
> +	if (ret) {

how about something like this:

diff --git a/sound/soc/qcom/qdsp6/q6routing.c
b/sound/soc/qcom/qdsp6/q6routing.c
index d076c99f197f..4816d4b9a48c 100644
--- a/sound/soc/qcom/qdsp6/q6routing.c
+++ b/sound/soc/qcom/qdsp6/q6routing.c
@@ -1209,7 +1209,7 @@ static int q6pcm_routing_probe(struct
platform_device *pdev)
 {
        struct device *dev = &pdev->dev;

-       routing_data = kzalloc_obj(*routing_data);
+       routing_data = devm_kzalloc_obj(dev, *routing_data);
        if (!routing_data)
                return -ENOMEM;

@@ -1224,7 +1224,6 @@ static int q6pcm_routing_probe(struct
platform_device *pdev)

 static void q6pcm_routing_remove(struct platform_device *pdev)
 {
-       kfree(routing_data);
        routing_data = NULL;
 }



> +		kfree(routing_data);
> +		routing_data = NULL;
> +	}
> +	return ret;
>  }
>  
>  static void q6pcm_routing_remove(struct platform_device *pdev)

[PATCH v2] ASoC: qdsp6: q6routing: Fix memory leak on probe failure

[Tang Bin]

routing_data is allocated with kzalloc() and stored in a global static
pointer. If devm_snd_soc_register_component() fails, the probe function
returns directly without freeing routing_data. Since the remove callback
is not invoked on probe failure, this leads to a memory leak. On a probe
retry, a new routing_data overwrites the global pointer, permanently
losing the previous allocation.

Fix this by switching to devm_kzalloc_obj() for the allocation. This
ensures the memory is automatically freed by the device core if probe
fails or when the driver is unbound. Consequently, the manual kfree()
in the remove callback is no longer needed and must be removed to avoid
a double-free.

Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver")
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
---
Changes in v2:
- Use devm_kzalloc_obj() to let the device core manage the memory
  lifecycle, as suggested by Srinivas Kandagatla. This eliminates the
  need for manual error handling and prevents a double-free in remove.

 sound/soc/qcom/qdsp6/q6routing.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
index d076c99f1..4816d4b9a 100644
--- a/sound/soc/qcom/qdsp6/q6routing.c
+++ b/sound/soc/qcom/qdsp6/q6routing.c
@@ -1209,7 +1209,7 @@ static int q6pcm_routing_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 
-	routing_data = kzalloc_obj(*routing_data);
+	routing_data = devm_kzalloc_obj(dev, *routing_data);
 	if (!routing_data)
 		return -ENOMEM;
 
@@ -1224,7 +1224,6 @@ static int q6pcm_routing_probe(struct platform_device *pdev)
 
 static void q6pcm_routing_remove(struct platform_device *pdev)
 {
-	kfree(routing_data);
 	routing_data = NULL;
 }
 
-- 
2.52.0.windows.1

Re: [PATCH v2] ASoC: qdsp6: q6routing: Fix memory leak on probe failure

[Srinivas Kandagatla]

On 10/28/26 1:57 AM, Tang Bin wrote:
> routing_data is allocated with kzalloc() and stored in a global static
> pointer. If devm_snd_soc_register_component() fails, the probe function
> returns directly without freeing routing_data. Since the remove callback
> is not invoked on probe failure, this leads to a memory leak. On a probe
> retry, a new routing_data overwrites the global pointer, permanently
> losing the previous allocation.
> 
> Fix this by switching to devm_kzalloc_obj() for the allocation. This
> ensures the memory is automatically freed by the device core if probe
> fails or when the driver is unbound. Consequently, the manual kfree()
> in the remove callback is no longer needed and must be removed to avoid
> a double-free.
> 
> Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver")
> Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
> ---
lgtm,

Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>

--Srini

> Changes in v2:
> - Use devm_kzalloc_obj() to let the device core manage the memory
>   lifecycle, as suggested by Srinivas Kandagatla. This eliminates the
>   need for manual error handling and prevents a double-free in remove.
> 
>  sound/soc/qcom/qdsp6/q6routing.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
> index d076c99f1..4816d4b9a 100644
> --- a/sound/soc/qcom/qdsp6/q6routing.c
> +++ b/sound/soc/qcom/qdsp6/q6routing.c
> @@ -1209,7 +1209,7 @@ static int q6pcm_routing_probe(struct platform_device *pdev)
>  {
>  	struct device *dev = &pdev->dev;
>  
> -	routing_data = kzalloc_obj(*routing_data);
> +	routing_data = devm_kzalloc_obj(dev, *routing_data);
>  	if (!routing_data)
>  		return -ENOMEM;
>  
> @@ -1224,7 +1224,6 @@ static int q6pcm_routing_probe(struct platform_device *pdev)
>  
>  static void q6pcm_routing_remove(struct platform_device *pdev)
>  {
> -	kfree(routing_data);
>  	routing_data = NULL;
>  }
>