From: Hans de Goede <johannes.goede@oss.qualcomm.com>
To: Mark Brown <broonie@kernel.org>, Dennis Gilmore <dennis@ausil.us>,
kees@kernel.org
Cc: lgirdwood@gmail.com, perex@perex.cz, tiwai@suse.com,
gustavoars@kernel.org, linux-sound@vger.kernel.org,
linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org,
michael.hennerich@analog.com, nuno.sa@analog.com,
dlechner@baylibre.com, linux-spi@vger.kernel.org,
miriam.rachel.korenblit@intel.com,
linux-wireless@vger.kernel.org
Subject: Re: [PATCH] ASoC: soc-core: start rtd->num_components at zero
Date: Thu, 12 Nov 2026 14:34:17 +0100 [thread overview]
Message-ID: <f55dddf1-d745-471a-8001-8f9e5768d97d@oss.qualcomm.com> (raw)
In-Reply-To: <179448342405.66517.5463730214277229760.b4-review@b4>
Hi Mark,
I was about to send a regression bug report for 7.4-rc2 but I first
checked the list to see if a fix was already available and I'm happy
to report that this fixes things for me:
Tested-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
On 12-Nov-26 12:37, Mark Brown wrote:
>> Since the conversion to devm_kzalloc_flex(), the allocator sets the
>> __counted_by() counter num_components to the allocated length
>> (num_cpus + num_codecs + num_platforms). This only happens when the
>> compiler supports __builtin_counted_by_ref() (GCC 16 here). With
>> older compilers the counter stays zero, as before.
>
> This doesn't apply against current code, I think this is an issue that
> was already fixed. Please check and resend if it's still needed.
This applies cleanly on 7.4-rc2 and fixes a regression breaking
audio on a lot of different devices there.
If some form of this is already in ASoC-next, then that needs to be
send to Linux as a fix ASAP.
Regards,
Hans
p.s.
@Kees, have you seen Dennis' remark about the same problem with
devm_kzalloc_flex() changing the semantics with the num-components
counter now no longer being initialized to zero in at least 2 other
places? :
"""
Kees, the same pattern (a *_flex() allocation followed by code that uses
the counter as a fill index starting from zero) looks to be present in
two places converted by 69050f8d6d07 ("treewide: Replace kmalloc with
kmalloc_obj for non-scalar types"). I have only read the code for these.
I have no hardware for either and have not reproduced them, so please
treat them as possible issues rather than confirmed bugs:
- drivers/spi/spi-axi-spi-engine.c: spi_engine_optimize_message()
allocates p with kzalloc_flex(*p, instructions, p_dry.length + 1),
which presets p->length, and spi_engine_compile_message() then
appends with p->length++ through spi_engine_program_add_cmd().
- drivers/net/wireless/intel/iwlwifi/mld/d3.c:
iwl_mld_process_netdetect_res() allocates netdetect_info with
kzalloc_flex(..., matches, n_matches), presetting n_matches, and
iwl_mld_set_netdetect_info() stores at matches[n_matches] and then
increments it. The per-match kzalloc_flex(..., channels, n_channels)
has the same issue with match->n_channels.
"""
prev parent reply other threads:[~2026-11-12 13:34 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-12 2:52 Dennis Gilmore
2026-11-12 11:37 ` Mark Brown
2026-11-12 13:32 ` Hans de Goede
2026-11-12 13:34 ` Hans de Goede [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f55dddf1-d745-471a-8001-8f9e5768d97d@oss.qualcomm.com \
--to=johannes.goede@oss.qualcomm.com \
--cc=broonie@kernel.org \
--cc=dennis@ausil.us \
--cc=dlechner@baylibre.com \
--cc=gustavoars@kernel.org \
--cc=kees@kernel.org \
--cc=lgirdwood@gmail.com \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=michael.hennerich@analog.com \
--cc=miriam.rachel.korenblit@intel.com \
--cc=nuno.sa@analog.com \
--cc=perex@perex.cz \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®