[PATCH v1 0/2] ASoC: tegra: Support auxiliary devices

[PATCH v1 0/2] ASoC: tegra: Support auxiliary devices

[Svyatoslav Ryhel]

Add support for auxiliary devices, such as amplifiers, sound-muxes or dsp,
to be added to the sound card.

Svyatoslav Ryhel (2):
  ASoC: nvidia,tegra-audio-common: Document nvidia,aux-devs property
  ASoC: tegra: Support auxiliary devices

 .../devicetree/bindings/sound/nvidia,tegra-audio-common.yaml | 5 +++++
 sound/soc/tegra/tegra_asoc_machine.c                         | 4 ++++
 2 files changed, 9 insertions(+)

-- 
2.53.0

[PATCH v1 1/2] ASoC: nvidia,tegra-audio-common: Document nvidia,aux-devs property

[Svyatoslav Ryhel]

Add nvidia,aux-devs which can contain a list of phandles pointing to
auxiliary devices, such as amplifiers, sound-muxes or dsp, to be added to
the sound card.

Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
 .../devicetree/bindings/sound/nvidia,tegra-audio-common.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Documentation/devicetree/bindings/sound/nvidia,tegra-audio-common.yaml b/Documentation/devicetree/bindings/sound/nvidia,tegra-audio-common.yaml
index 2588589ad62d3..316806fc7346e 100644
--- a/Documentation/devicetree/bindings/sound/nvidia,tegra-audio-common.yaml
+++ b/Documentation/devicetree/bindings/sound/nvidia,tegra-audio-common.yaml
@@ -48,6 +48,11 @@ properties:
     $ref: /schemas/types.yaml#/definitions/phandle
     description: The phandle of audio codec
 
+  nvidia,aux-devs:
+    $ref: /schemas/types.yaml#/definitions/phandle-array
+    description: List of phandles pointing to auxiliary devices,
+      such as amplifiers or dsp, to be added to the sound card.
+
   nvidia,spkr-en-gpios:
     maxItems: 1
     description: The GPIO that enables the speakers
-- 
2.53.0

[PATCH v1 2/2] ASoC: tegra: Support auxiliary devices

[Svyatoslav Ryhel]

Add support for auxiliary devices, such as amplifiers, sound-muxes or dsp,
to be added to the sound card.

Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
 sound/soc/tegra/tegra_asoc_machine.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/soc/tegra/tegra_asoc_machine.c b/sound/soc/tegra/tegra_asoc_machine.c
index 50b23bbb637bd..e4af049fd7e89 100644
--- a/sound/soc/tegra/tegra_asoc_machine.c
+++ b/sound/soc/tegra/tegra_asoc_machine.c
@@ -550,6 +550,10 @@ int tegra_asoc_machine_probe(struct platform_device *pdev)
 	if (asoc->add_common_snd_ops)
 		card->dai_link->ops = &tegra_machine_snd_ops;
 
+	err = snd_soc_of_parse_aux_devs(card, "nvidia,aux-devs");
+	if (err)
+		return err;
+
 	if (!card->owner)
 		card->owner = THIS_MODULE;
 	if (!card->driver_name)
-- 
2.53.0

Re: [PATCH v1 2/2] ASoC: tegra: Support auxiliary devices

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] ASoC: tegra: UAF due to devm allocation in static snd_soc_card
- [Medium] mm: device_node leak for auxiliary devices in tegra_asoc_machine
--

commit 4f6320da37c0588cbe6424de9441b305591341f2
Author: Svyatoslav Ryhel <clamor95@gmail.com>

ASoC: tegra: Support auxiliary devices

Add support for auxiliary devices, such as amplifiers, sound-muxes or dsp,
to be added to the sound card.

> diff --git a/sound/soc/tegra/tegra_asoc_machine.c b/sound/soc/tegra/tegra_asoc_machine.c
> index 50b23bbb637bd..e4af049fd7e89 100644
> --- a/sound/soc/tegra/tegra_asoc_machine.c
> +++ b/sound/soc/tegra/tegra_asoc_machine.c
> @@ -550,6 +550,10 @@ int tegra_asoc_machine_probe(struct platform_device *pdev)
>  	if (asoc->add_common_snd_ops)
>  		card->dai_link->ops = &tegra_machine_snd_ops;
>  
> +	err = snd_soc_of_parse_aux_devs(card, "nvidia,aux-devs");
> +	if (err)
> +		return err;
> +

[Severity: High]
Could this lead to a use-after-free during deferred probe?

In tegra_asoc_machine_probe(), card points to a statically allocated
snd_soc_card structure obtained from of_device_get_match_data(dev). When
snd_soc_of_parse_aux_devs() is called, it allocates card->aux_dev using
devm_kcalloc() and updates card->num_aux_devs:

sound/soc/soc-core.c:snd_soc_of_parse_aux_devs() {
    ...
    aux = devm_kcalloc(card->dev, num, sizeof(*aux), GFP_KERNEL);
    ...
    card->aux_dev = aux;
    card->num_aux_devs = num;
    ...
}

If probe subsequently fails (for example, if clk_get returns -EPROBE_DEFER
later in tegra_asoc_machine_probe()), the devm subsystem will free
card->aux_dev, but card->num_aux_devs will retain its positive value
because the snd_soc_card is statically allocated.

If the device is probed again but the nvidia,aux-devs property is now
missing (e.g., due to a device tree overlay change or probing a different
sound card), snd_soc_of_parse_aux_devs() will return 0 without clearing
the dangling pointer:

sound/soc/soc-core.c:snd_soc_of_parse_aux_devs() {
    ...
    num = of_count_phandle_with_args(node, propname, NULL);
    if (num == -ENOENT) {
        return 0;
    }
    ...
}

This means snd_soc_register_card() could iterate over the freed
card->aux_dev array in soc_bind_aux_dev(), resulting in a use-after-free.

[Severity: Medium]
Will this leak device_node references on driver removal or probe failure?

snd_soc_of_parse_aux_devs() acquires device_node references via
of_parse_phandle(), and stores them in card->aux_dev[i].dlc.of_node:

sound/soc/soc-core.c:snd_soc_of_parse_aux_devs() {
    ...
    for_each_card_pre_auxs(card, i, aux) {
        aux->dlc.of_node = of_parse_phandle(node, propname, i);
        if (!aux->dlc.of_node)
            return -EINVAL;
    }
    ...
}

The tegra_asoc_machine driver does not appear to provide a .remove callback
or error rollback path to drop these references using of_node_put(), and the
ASoC core does not clean them up on card unregistration. This could lead to
a memory leak when the driver is unbound or if probe fails later.

Additionally, if snd_soc_of_parse_aux_devs() fails partway through the loop
(returning -EINVAL), it appears to leak any node references it had already
successfully acquired in earlier iterations.

>  	if (!card->owner)
>  		card->owner = THIS_MODULE;
>  	if (!card->driver_name)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013180253.477605-1-clamor95@gmail.com?part=2