Re: [PATCH v1 2/2] ASoC: tegra: Support auxiliary devices

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] ASoC: tegra: UAF due to devm allocation in static snd_soc_card
- [Medium] mm: device_node leak for auxiliary devices in tegra_asoc_machine
--

commit 4f6320da37c0588cbe6424de9441b305591341f2
Author: Svyatoslav Ryhel <clamor95@gmail.com>

ASoC: tegra: Support auxiliary devices

Add support for auxiliary devices, such as amplifiers, sound-muxes or dsp,
to be added to the sound card.

> diff --git a/sound/soc/tegra/tegra_asoc_machine.c b/sound/soc/tegra/tegra_asoc_machine.c
> index 50b23bbb637bd..e4af049fd7e89 100644
> --- a/sound/soc/tegra/tegra_asoc_machine.c
> +++ b/sound/soc/tegra/tegra_asoc_machine.c
> @@ -550,6 +550,10 @@ int tegra_asoc_machine_probe(struct platform_device *pdev)
>  	if (asoc->add_common_snd_ops)
>  		card->dai_link->ops = &tegra_machine_snd_ops;
>  
> +	err = snd_soc_of_parse_aux_devs(card, "nvidia,aux-devs");
> +	if (err)
> +		return err;
> +

[Severity: High]
Could this lead to a use-after-free during deferred probe?

In tegra_asoc_machine_probe(), card points to a statically allocated
snd_soc_card structure obtained from of_device_get_match_data(dev). When
snd_soc_of_parse_aux_devs() is called, it allocates card->aux_dev using
devm_kcalloc() and updates card->num_aux_devs:

sound/soc/soc-core.c:snd_soc_of_parse_aux_devs() {
    ...
    aux = devm_kcalloc(card->dev, num, sizeof(*aux), GFP_KERNEL);
    ...
    card->aux_dev = aux;
    card->num_aux_devs = num;
    ...
}

If probe subsequently fails (for example, if clk_get returns -EPROBE_DEFER
later in tegra_asoc_machine_probe()), the devm subsystem will free
card->aux_dev, but card->num_aux_devs will retain its positive value
because the snd_soc_card is statically allocated.

If the device is probed again but the nvidia,aux-devs property is now
missing (e.g., due to a device tree overlay change or probing a different
sound card), snd_soc_of_parse_aux_devs() will return 0 without clearing
the dangling pointer:

sound/soc/soc-core.c:snd_soc_of_parse_aux_devs() {
    ...
    num = of_count_phandle_with_args(node, propname, NULL);
    if (num == -ENOENT) {
        return 0;
    }
    ...
}

This means snd_soc_register_card() could iterate over the freed
card->aux_dev array in soc_bind_aux_dev(), resulting in a use-after-free.

[Severity: Medium]
Will this leak device_node references on driver removal or probe failure?

snd_soc_of_parse_aux_devs() acquires device_node references via
of_parse_phandle(), and stores them in card->aux_dev[i].dlc.of_node:

sound/soc/soc-core.c:snd_soc_of_parse_aux_devs() {
    ...
    for_each_card_pre_auxs(card, i, aux) {
        aux->dlc.of_node = of_parse_phandle(node, propname, i);
        if (!aux->dlc.of_node)
            return -EINVAL;
    }
    ...
}

The tegra_asoc_machine driver does not appear to provide a .remove callback
or error rollback path to drop these references using of_node_put(), and the
ASoC core does not clean them up on card unregistration. This could lead to
a memory leak when the driver is unbound or if probe fails later.

Additionally, if snd_soc_of_parse_aux_devs() fails partway through the loop
(returning -EINVAL), it appears to leak any node references it had already
successfully acquired in earlier iterations.

>  	if (!card->owner)
>  		card->owner = THIS_MODULE;
>  	if (!card->driver_name)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013180253.477605-1-clamor95@gmail.com?part=2