Re: [PATCH 2/2] ASoC: meson: meson-card-utils: Drop redundant probe error messages

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Preexisting dangling pointer dereference (Use-After-Free) and double-free in the `meson_card_reallocate_links()` error path.
--

--- Patch [2]: [PATCH 2/2] ASoC: meson: meson-card-utils: Drop redundant probe error messages ---
commit 94de42ca0b099508e39600d3d3d0d282a866cfb3
Author: bui duc phuc <phucduc.bui@gmail.com>

ASoC: meson: meson-card-utils: Drop redundant probe error messages
    
This commit removes redundant dev_err() calls from meson_card_probe()
since the errors are already reported deeper in the call chain.

> diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
> index cdb759b466ad4..48047312cf47f 100644
> --- a/sound/soc/meson/meson-card-utils.c
> +++ b/sound/soc/meson/meson-card-utils.c
[ ... ]
> @@ -289,17 +289,13 @@ int meson_card_probe(struct platform_device *pdev)
>  
>  	ret = meson_card_parse_of_optional(&priv->card, "audio-widgets",
>  					   snd_soc_of_parse_audio_simple_widgets);
> -	if (ret) {
> -		dev_err(dev, "error while parsing widgets\n");
> +	if (ret)
>  		return ret;
> -	}
>  
>  	ret = meson_card_add_links(&priv->card);
>  	if (ret)

[Severity: High]
This isn't a bug introduced by this patch, but if meson_card_add_links()
fails, could it trigger a use-after-free and double-free in the error
handling path?

If meson_card_reallocate_links() fails its second krealloc() for
priv->link_data, it jumps to err_ldata and frees the links array:

sound/soc/meson/meson-card-utils.c:meson_card_reallocate_links() {
    ...
err_ldata:
	kfree(links);
err_links:
	dev_err(priv->card.dev, "failed to allocate links\n");
	return -ENOMEM;
}

However, priv->card.dai_link retains its old value pointing to the freed
memory.

When the probe function receives the error, it jumps to out_err and calls
meson_card_clean_references(), which iterates over card->dai_link:

sound/soc/meson/meson-card-utils.c:meson_card_clean_references() {
    ...
	if (card->dai_link) {
		for_each_card_prelinks(card, i, link) {
			...
		kfree(card->dai_link);
}

This appears to dereference the freed links array and then kfree() it again.

Could priv->card.dai_link be set to NULL before returning from the
error path in meson_card_reallocate_links() to prevent this?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260814094211.25151-1-phucduc.bui@gmail.com?part=2

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic