[PATCH] ASoC: wm8994: Fix potential DSP control text array leaks

[PATCH] ASoC: wm8994: Fix potential DSP control text array leaks

[Guangshuo Li]

wm8958_dsp2_init() allocates text arrays for the DSP mode controls,
but component removal does not free them.

Release the arrays on removal and clear their pointers so a later
component probe that stops partway through allocation cannot leave
old pointers for the next removal.

This issue was found by our static analysis tool under development.

Fixes: 131d81061eba ("ASoC: Allow user-specified WM8958 multiband compressor configurations")
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
 sound/soc/codecs/wm8994.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 6b91e02f130b..1c7619f1d481 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -4640,6 +4640,14 @@ static void wm8994_component_remove(struct snd_soc_component *component)
 	release_firmware(wm8994->mbc_vss);
 	release_firmware(wm8994->enh_eq);
 	kfree(wm8994->retune_mobile_texts);
+	kfree(wm8994->mbc_texts);
+	kfree(wm8994->vss_texts);
+	kfree(wm8994->vss_hpf_texts);
+	kfree(wm8994->enh_eq_texts);
+	wm8994->mbc_texts = NULL;
+	wm8994->vss_texts = NULL;
+	wm8994->vss_hpf_texts = NULL;
+	wm8994->enh_eq_texts = NULL;
 }
 
 static const struct snd_soc_component_driver soc_component_dev_wm8994 = {

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4

Re: [PATCH] ASoC: wm8994: Fix potential DSP control text array leaks

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] ASoC: wm8994: uncanceled delayed work in
  wm8994_mic_detect() [1]
--

commit b1875e92cf130d31ec4640f8cfad93d507df6633
Author: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>

ASoC: wm8994: Fix potential DSP control text array leaks

This commit frees the DSP mode control text arrays in
wm8994_component_remove() and clears their pointers.

> diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
> index 6b91e02f130b3..1c7619f1d481a 100644
> --- a/sound/soc/codecs/wm8994.c
> +++ b/sound/soc/codecs/wm8994.c
> @@ -4640,6 +4640,14 @@ static void wm8994_component_remove(struct snd_soc_component *component)
>  	release_firmware(wm8994->mbc_vss);
>  	release_firmware(wm8994->enh_eq);
>  	kfree(wm8994->retune_mobile_texts);
> +	kfree(wm8994->mbc_texts);
> +	kfree(wm8994->vss_texts);
> +	kfree(wm8994->vss_hpf_texts);
> +	kfree(wm8994->enh_eq_texts);
> +	wm8994->mbc_texts = NULL;
> +	wm8994->vss_texts = NULL;
> +	wm8994->vss_hpf_texts = NULL;
> +	wm8994->enh_eq_texts = NULL;
>  }

[Severity: Critical]
This problem wasn't introduced by this patch, but can wm8994->mic_work
remain pending [1] when wm8994_component_remove() or
wm8994_mic_detect() tears down microphone detection?

wm8994_mic_irq() queues priv->mic_work on system_power_efficient_wq with a
250 ms delay:

sound/soc/codecs/wm8994.c:wm8994_mic_irq() {
	...
	queue_delayed_work(system_power_efficient_wq,
			   &priv->mic_work, msecs_to_jiffies(250));

	return IRQ_HANDLED;
}

Neither wm8994_component_remove() (after freeing micdet_irq) nor
wm8994_mic_detect() (when called with a null jack to disable detection)
cancels wm8994->mic_work:

CPU0                              CPU1 (kworker)
wm8994_mic_irq()
  queue_delayed_work(..., &priv->mic_work, ...)
wm8994_component_remove()
  free_irq(wm8994->micdet_irq, wm8994)
  ...
  (wm8994_priv / card freed)
                                  wm8994_mic_work()
                                    snd_soc_jack_report(
                                      priv->micdet[0].jack, ...)
                                      <-- use-after-free

If wm8994_mic_work() runs during or after sound card or codec teardown, it
accesses freed wm8994_priv or snd_soc_jack memory in snd_soc_jack_report()
and during codec register accesses.

[1] https://sashiko.dev/#/bug/linux-f4847a1a-9821-49ac-b084-a432a2aa712f

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112-88a3a7ff32-asoc-wm8994@mail.sdu.edu.cn?part=1