[PATCH] ALSA: hda/core: Fix double free on stream page allocation failure

[PATCH] ALSA: hda/core: Fix double free on stream page allocation failure

[Sasha Levin]

Since commit f16eaa38ea64 ("ALSA: hda/core: add cleanup in
snd_hdac_bus_alloc_stream_pages()"), snd_hdac_bus_alloc_stream_pages()
frees the BDL and position buffers it has already allocated when a
later allocation fails.  snd_dma_free_pages() doesn't clear dmab->area,
so the freed buffers still look allocated to
snd_hdac_bus_free_stream_pages(), which the HDA controller drivers call
from their destructors, and they are freed a second time when the
device is removed.

With fault injection failing the CORB/RIRB buffer allocation of
snd-hda-intel on a QEMU ich9-intel-hda, unbinding the device then
crashes:

  page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
  kernel BUG at include/linux/mm.h:1986!
  Call Trace:
   ___free_pages+0x9b/0xa0
   free_pages_exact+0xa5/0xd0
   snd_hdac_bus_free_stream_pages+0x43/0xb0 [snd_hda_core]
   azx_free+0xb3/0x1b0 [snd_hda_intel]
   azx_dev_free+0xd/0x20 [snd_hda_intel]

Clear the buffer pointers after freeing them in the error path.

Fixes: f16eaa38ea64 ("ALSA: hda/core: add cleanup in snd_hdac_bus_alloc_stream_pages()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/core/controller.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sound/hda/core/controller.c b/sound/hda/core/controller.c
index a7acd3418ae8a..32574dc899fad 100644
--- a/sound/hda/core/controller.c
+++ b/sound/hda/core/controller.c
@@ -764,10 +764,13 @@ int snd_hdac_bus_alloc_stream_pages(struct hdac_bus *bus)
 
 error_posbuf:
 	snd_dma_free_pages(&bus->posbuf);
+	bus->posbuf.area = NULL;
 error_bdl:
 	list_for_each_entry(s, &bus->stream_list, list) {
-		if (s->bdl.area)
+		if (s->bdl.area) {
 			snd_dma_free_pages(&s->bdl);
+			s->bdl.area = NULL;
+		}
 	}
 	return -ENOMEM;
 }
-- 
2.53.0

Re: [PATCH] ALSA: hda/core: Fix double free on stream page allocation failure

[Takashi Iwai]

On Wed, 28 Oct 2026 15:44:43 +0100,
Sasha Levin wrote:
> 
> Since commit f16eaa38ea64 ("ALSA: hda/core: add cleanup in
> snd_hdac_bus_alloc_stream_pages()"), snd_hdac_bus_alloc_stream_pages()
> frees the BDL and position buffers it has already allocated when a
> later allocation fails.  snd_dma_free_pages() doesn't clear dmab->area,
> so the freed buffers still look allocated to
> snd_hdac_bus_free_stream_pages(), which the HDA controller drivers call
> from their destructors, and they are freed a second time when the
> device is removed.
> 
> With fault injection failing the CORB/RIRB buffer allocation of
> snd-hda-intel on a QEMU ich9-intel-hda, unbinding the device then
> crashes:
> 
>   page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
>   kernel BUG at include/linux/mm.h:1986!
>   Call Trace:
>    ___free_pages+0x9b/0xa0
>    free_pages_exact+0xa5/0xd0
>    snd_hdac_bus_free_stream_pages+0x43/0xb0 [snd_hda_core]
>    azx_free+0xb3/0x1b0 [snd_hda_intel]
>    azx_dev_free+0xd/0x20 [snd_hda_intel]
> 
> Clear the buffer pointers after freeing them in the error path.
> 
> Fixes: f16eaa38ea64 ("ALSA: hda/core: add cleanup in snd_hdac_bus_alloc_stream_pages()")
> Signed-off-by: Sasha Levin <sashal@kernel.org>

Applied now.  Thanks.


Takashi