[PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Emanuele Ghidoli]

From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>


Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
annotated with __counted_by(num_components), so when the compiler
provides __builtin_counted_by_ref() the allocation now also sets
rtd->num_components to the number of allocated slots.

snd_soc_rtd_add_component() fills components[] one entry at a time and
expects num_components to start at zero. Starting from the allocated
size, for_each_rtd_components() stops at the first, still NULL, entry,
so the runtime has no components: they are not probed, no controls or
user-visible PCM devices are created and the card registers empty,
without any error message. In addition, each added component is stored
past the end of components[]. On the tested board these stores still
land in the slack of the kmalloc bucket that devres rounds the
allocation up to, so KASAN does not report them.

Reset num_components after the allocation.

Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
is listed in /proc/asound/cards, but /proc/asound/pcm is empty and

  amixer: Unable to find simple control 'Capture Mux',0
  aplay: main:850: audio open error: No such file or directory

Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
GCC 16.2): the failure is there without this change; with it, playback,
capture and the codec controls work again.

The root cause analysis, this change and the testing were done with the
help of an AI coding assistant (Claude Code, Claude Opus 5.5).

Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
---
4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
so this is based on v7.4-rc2.

The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
too: none of them fills a __counted_by() counter one entry at a time, so
this one looks like the only user hit by the preset counter.

 sound/soc/soc-core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 68b54e509b65..06a1d5718997 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -387,6 +387,12 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
 		device_unregister(dev);
 		return NULL;
 	}
+	/*
+	 * devm_kzalloc_flex() presets the __counted_by() counter to the
+	 * allocated size when the compiler has __builtin_counted_by_ref(),
+	 * but snd_soc_rtd_add_component() expects it to start from zero.
+	 */
+	rtd->num_components = 0;
 
 	rtd->dev = dev;
 	INIT_LIST_HEAD(&rtd->list);

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.53.0

Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Takashi Iwai]

On Mon, 09 Nov 2026 11:25:20 +0100,
Emanuele Ghidoli wrote:
On Mon, 09 Nov 2026 11:25:20 +0100,
Emanuele Ghidoli wrote:
> 
> From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> 
> 
> Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
> devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
> in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
> annotated with __counted_by(num_components), so when the compiler
> provides __builtin_counted_by_ref() the allocation now also sets
> rtd->num_components to the number of allocated slots.
> 
> snd_soc_rtd_add_component() fills components[] one entry at a time and
> expects num_components to start at zero. Starting from the allocated
> size, for_each_rtd_components() stops at the first, still NULL, entry,
> so the runtime has no components: they are not probed, no controls or
> user-visible PCM devices are created and the card registers empty,
> without any error message. In addition, each added component is stored
> past the end of components[]. On the tested board these stores still
> land in the slack of the kmalloc bucket that devres rounds the
> allocation up to, so KASAN does not report them.
> 
> Reset num_components after the allocation.
> 
> Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
> is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
> 
>   amixer: Unable to find simple control 'Capture Mux',0
>   aplay: main:850: audio open error: No such file or directory
> 
> Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
> GCC 16.2): the failure is there without this change; with it, playback,
> capture and the codec controls work again.
> 
> The root cause analysis, this change and the testing were done with the
> help of an AI coding assistant (Claude Code, Claude Opus 5.5).
> 
> Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> ---
> 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
> so this is based on v7.4-rc2.
> 
> The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
> too: none of them fills a __counted_by() counter one entry at a time, so
> this one looks like the only user hit by the preset counter.

I guess a bugzilla entry that was reported recently is also related
with this problem.
  https://bugzilla.kernel.org/show_bug.cgi?id=222249

My first gut feeling was that it might be safer to revert the use of
devm_kmalloc_flex() in that code, as it has a significant side-effect
unlike other straight conversions.  But, if this fix covers well, we
can go with this fix, of course.


thanks,

Takashi


> 
>  sound/soc/soc-core.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
> index 68b54e509b65..06a1d5718997 100644
> --- a/sound/soc/soc-core.c
> +++ b/sound/soc/soc-core.c
> @@ -387,6 +387,12 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
>  		device_unregister(dev);
>  		return NULL;
>  	}
> +	/*
> +	 * devm_kzalloc_flex() presets the __counted_by() counter to the
> +	 * allocated size when the compiler has __builtin_counted_by_ref(),
> +	 * but snd_soc_rtd_add_component() expects it to start from zero.
> +	 */
> +	rtd->num_components = 0;
>  
>  	rtd->dev = dev;
>  	INIT_LIST_HEAD(&rtd->list);
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> -- 
> 2.53.0
> 
> 
> From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> 
> 
> Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
> devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
> in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
> annotated with __counted_by(num_components), so when the compiler
> provides __builtin_counted_by_ref() the allocation now also sets
> rtd->num_components to the number of allocated slots.
> 
> snd_soc_rtd_add_component() fills components[] one entry at a time and
> expects num_components to start at zero. Starting from the allocated
> size, for_each_rtd_components() stops at the first, still NULL, entry,
> so the runtime has no components: they are not probed, no controls or
> user-visible PCM devices are created and the card registers empty,
> without any error message. In addition, each added component is stored
> past the end of components[]. On the tested board these stores still
> land in the slack of the kmalloc bucket that devres rounds the
> allocation up to, so KASAN does not report them.
> 
> Reset num_components after the allocation.
> 
> Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
> is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
> 
>   amixer: Unable to find simple control 'Capture Mux',0
>   aplay: main:850: audio open error: No such file or directory
> 
> Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
> GCC 16.2): the failure is there without this change; with it, playback,
> capture and the codec controls work again.
> 
> The root cause analysis, this change and the testing were done with the
> help of an AI coding assistant (Claude Code, Claude Opus 5.5).
> 
> Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> ---
> 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
> so this is based on v7.4-rc2.
> 
> The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
> too: none of them fills a __counted_by() counter one entry at a time, so
> this one looks like the only user hit by the preset counter.
> 
>  sound/soc/soc-core.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
> index 68b54e509b65..06a1d5718997 100644
> --- a/sound/soc/soc-core.c
> +++ b/sound/soc/soc-core.c
> @@ -387,6 +387,12 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
>  		device_unregister(dev);
>  		return NULL;
>  	}
> +	/*
> +	 * devm_kzalloc_flex() presets the __counted_by() counter to the
> +	 * allocated size when the compiler has __builtin_counted_by_ref(),
> +	 * but snd_soc_rtd_add_component() expects it to start from zero.
> +	 */
> +	rtd->num_components = 0;
>  
>  	rtd->dev = dev;
>  	INIT_LIST_HEAD(&rtd->list);
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> -- 
> 2.53.0
>