Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Kees Cook <kees@kernel.org>]

On November 10, 2026 9:50:08 PM PST, Kees Cook <kees@kernel.org> wrote:
>
>
>On November 9, 2026 3:07:33 AM PST, Takashi Iwai <tiwai@suse.de> wrote:
>>On Mon, 09 Nov 2026 11:25:20 +0100,
>>Emanuele Ghidoli wrote:
>>On Mon, 09 Nov 2026 11:25:20 +0100,
>>Emanuele Ghidoli wrote:
>>> 
>>> From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
>>> 
>>> 
>>> Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
>>> devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
>>> in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
>>> annotated with __counted_by(num_components), so when the compiler
>>> provides __builtin_counted_by_ref() the allocation now also sets
>>> rtd->num_components to the number of allocated slots.
>>> 
>>> snd_soc_rtd_add_component() fills components[] one entry at a time and
>>> expects num_components to start at zero. Starting from the allocated
>>> size, for_each_rtd_components() stops at the first, still NULL, entry,
>>> so the runtime has no components: they are not probed, no controls or
>>> user-visible PCM devices are created and the card registers empty,
>>> without any error message. In addition, each added component is stored
>>> past the end of components[]. On the tested board these stores still
>>> land in the slack of the kmalloc bucket that devres rounds the
>>> allocation up to, so KASAN does not report them.
>>> 
>>> Reset num_components after the allocation.
>>> 
>>> Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
>>> is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
>>> 
>>>   amixer: Unable to find simple control 'Capture Mux',0
>>>   aplay: main:850: audio open error: No such file or directory
>>> 
>>> Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
>>> GCC 16.2): the failure is there without this change; with it, playback,
>>> capture and the codec controls work again.
>>> 
>>> The root cause analysis, this change and the testing were done with the
>>> help of an AI coding assistant (Claude Code, Claude Opus 5.5).
>>> 
>>> Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
>>> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
>>> ---
>>> 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
>>> so this is based on v7.4-rc2.
>>> 
>>> The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
>>> too: none of them fills a __counted_by() counter one entry at a time, so
>>> this one looks like the only user hit by the preset counter.
>
>Aggh, sorry for the problem, and thanks for checking the other cases.
>
>>
>>I guess a bugzilla entry that was reported recently is also related
>>with this problem.
>>  https://bugzilla.kernel.org/show_bug.cgi?id=222249
>>
>>My first gut feeling was that it might be safer to revert the use of
>>devm_kmalloc_flex() in that code, as it has a significant side-effect
>>unlike other straight conversions.  But, if this fix covers well, we
>>can go with this fix, of course.
>
>The problem is the annotation, IMO, as the counter member doesn't track allocation size, it tracks usage.

For example, what keeps snd_soc_rtd_add_component() from overflowing that array? If you want to protect the array, add another member, say max_component, and use that for the counter, which gets set at allocation time and protects the array from indexing beyond the actual allocation size.


-- 
Kees Cook