Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Takashi Iwai <tiwai@suse.de>]

On Mon, 09 Nov 2026 11:25:20 +0100,
Emanuele Ghidoli wrote:
On Mon, 09 Nov 2026 11:25:20 +0100,
Emanuele Ghidoli wrote:
> 
> From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> 
> 
> Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
> devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
> in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
> annotated with __counted_by(num_components), so when the compiler
> provides __builtin_counted_by_ref() the allocation now also sets
> rtd->num_components to the number of allocated slots.
> 
> snd_soc_rtd_add_component() fills components[] one entry at a time and
> expects num_components to start at zero. Starting from the allocated
> size, for_each_rtd_components() stops at the first, still NULL, entry,
> so the runtime has no components: they are not probed, no controls or
> user-visible PCM devices are created and the card registers empty,
> without any error message. In addition, each added component is stored
> past the end of components[]. On the tested board these stores still
> land in the slack of the kmalloc bucket that devres rounds the
> allocation up to, so KASAN does not report them.
> 
> Reset num_components after the allocation.
> 
> Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
> is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
> 
>   amixer: Unable to find simple control 'Capture Mux',0
>   aplay: main:850: audio open error: No such file or directory
> 
> Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
> GCC 16.2): the failure is there without this change; with it, playback,
> capture and the codec controls work again.
> 
> The root cause analysis, this change and the testing were done with the
> help of an AI coding assistant (Claude Code, Claude Opus 5.5).
> 
> Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> ---
> 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
> so this is based on v7.4-rc2.
> 
> The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
> too: none of them fills a __counted_by() counter one entry at a time, so
> this one looks like the only user hit by the preset counter.

I guess a bugzilla entry that was reported recently is also related
with this problem.
  https://bugzilla.kernel.org/show_bug.cgi?id=222249

My first gut feeling was that it might be safer to revert the use of
devm_kmalloc_flex() in that code, as it has a significant side-effect
unlike other straight conversions.  But, if this fix covers well, we
can go with this fix, of course.


thanks,

Takashi


> 
>  sound/soc/soc-core.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
> index 68b54e509b65..06a1d5718997 100644
> --- a/sound/soc/soc-core.c
> +++ b/sound/soc/soc-core.c
> @@ -387,6 +387,12 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
>  		device_unregister(dev);
>  		return NULL;
>  	}
> +	/*
> +	 * devm_kzalloc_flex() presets the __counted_by() counter to the
> +	 * allocated size when the compiler has __builtin_counted_by_ref(),
> +	 * but snd_soc_rtd_add_component() expects it to start from zero.
> +	 */
> +	rtd->num_components = 0;
>  
>  	rtd->dev = dev;
>  	INIT_LIST_HEAD(&rtd->list);
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> -- 
> 2.53.0
> 
> 
> From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> 
> 
> Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
> devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
> in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
> annotated with __counted_by(num_components), so when the compiler
> provides __builtin_counted_by_ref() the allocation now also sets
> rtd->num_components to the number of allocated slots.
> 
> snd_soc_rtd_add_component() fills components[] one entry at a time and
> expects num_components to start at zero. Starting from the allocated
> size, for_each_rtd_components() stops at the first, still NULL, entry,
> so the runtime has no components: they are not probed, no controls or
> user-visible PCM devices are created and the card registers empty,
> without any error message. In addition, each added component is stored
> past the end of components[]. On the tested board these stores still
> land in the slack of the kmalloc bucket that devres rounds the
> allocation up to, so KASAN does not report them.
> 
> Reset num_components after the allocation.
> 
> Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
> is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
> 
>   amixer: Unable to find simple control 'Capture Mux',0
>   aplay: main:850: audio open error: No such file or directory
> 
> Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
> GCC 16.2): the failure is there without this change; with it, playback,
> capture and the codec controls work again.
> 
> The root cause analysis, this change and the testing were done with the
> help of an AI coding assistant (Claude Code, Claude Opus 5.5).
> 
> Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> ---
> 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
> so this is based on v7.4-rc2.
> 
> The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
> too: none of them fills a __counted_by() counter one entry at a time, so
> this one looks like the only user hit by the preset counter.
> 
>  sound/soc/soc-core.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
> index 68b54e509b65..06a1d5718997 100644
> --- a/sound/soc/soc-core.c
> +++ b/sound/soc/soc-core.c
> @@ -387,6 +387,12 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
>  		device_unregister(dev);
>  		return NULL;
>  	}
> +	/*
> +	 * devm_kzalloc_flex() presets the __counted_by() counter to the
> +	 * allocated size when the compiler has __builtin_counted_by_ref(),
> +	 * but snd_soc_rtd_add_component() expects it to start from zero.
> +	 */
> +	rtd->num_components = 0;
>  
>  	rtd->dev = dev;
>  	INIT_LIST_HEAD(&rtd->list);
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> -- 
> 2.53.0
>