From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, Vinod Koul <vkoul@kernel.org>,
Bard Liao <yung-chuan.liao@linux.intel.com>,
Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>,
Rander Wang <rander.wang@intel.com>,
linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: [PATCH 04/21] soundwire: stream: Clean up allocated runtime resources on config failure
Date: Fri, 30 Oct 2026 10:46:43 +0000 [thread overview]
Message-ID: <20261030104840.3361217-5-lee@kernel.org> (raw)
In-Reply-To: <20261030104840.3361217-1-lee@kernel.org>
In sdw_stream_add_master() and sdw_stream_add_slave(), failures during
runtime or port configuration jump directly to the unlock label,
bypassing alloc_error and leaving newly allocated master/slave runtime
and port structures attached to the stream and bus lists.
Track whether ports were newly allocated in the current invocation and
route configuration failures through alloc_error so all resources
allocated by the failing call are released.
Fixes: ac3bc88cc56e ("soundwire: stream: separate alloc and config within sdw_stream_add_xxx()")
Closes: https://sashiko.dev/#/bug/linux-546e137d-6e4d-4f22-99c3-8ccc8beb5350
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
drivers/soundwire/stream.c | 33 +++++++++++++++++++++++++--------
1 file changed, 25 insertions(+), 8 deletions(-)
diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
index f225e5438ccf..97338a13c1a0 100644
--- a/drivers/soundwire/stream.c
+++ b/drivers/soundwire/stream.c
@@ -1026,14 +1026,18 @@ static int sdw_slave_port_alloc(struct sdw_slave *slave,
struct sdw_slave_runtime *s_rt,
unsigned int num_config)
{
- struct sdw_port_runtime *p_rt;
+ struct sdw_port_runtime *p_rt, *_p_rt;
int i;
/* Iterate for number of ports to perform initialization */
for (i = 0; i < num_config; i++) {
p_rt = sdw_port_alloc(&s_rt->port_list);
- if (!p_rt)
+ if (!p_rt) {
+ list_for_each_entry_safe(p_rt, _p_rt,
+ &s_rt->port_list, port_node)
+ sdw_port_free(p_rt);
return -ENOMEM;
+ }
}
return 0;
@@ -2018,6 +2022,7 @@ int sdw_stream_add_master(struct sdw_bus *bus,
struct sdw_stream_runtime *stream)
{
struct sdw_master_runtime *m_rt;
+ bool alloc_master_port = false;
bool alloc_master_rt = false;
int ret;
@@ -2063,18 +2068,21 @@ int sdw_stream_add_master(struct sdw_bus *bus,
if (ret)
goto alloc_error;
+ alloc_master_port = true;
stream->m_rt_count++;
}
ret = sdw_master_rt_config(m_rt, stream_config);
if (ret < 0)
- goto unlock;
+ goto alloc_error;
ret = sdw_config_stream(bus->dev, stream, stream_config, false);
if (ret)
- goto unlock;
+ goto alloc_error;
ret = sdw_master_port_config(m_rt, port_config);
+ if (ret)
+ goto alloc_error;
goto unlock;
@@ -2082,6 +2090,10 @@ int sdw_stream_add_master(struct sdw_bus *bus,
/*
* we only cleanup what was allocated in this routine
*/
+ if (alloc_master_port) {
+ sdw_master_port_free(m_rt);
+ stream->m_rt_count--;
+ }
if (alloc_master_rt)
sdw_master_rt_free(m_rt, stream);
unlock:
@@ -2147,6 +2159,7 @@ int sdw_stream_add_slave(struct sdw_slave *slave,
struct sdw_slave_runtime *s_rt;
struct sdw_master_runtime *m_rt;
bool alloc_master_rt = false;
+ bool alloc_slave_port = false;
bool alloc_slave_rt = false;
int ret;
@@ -2197,24 +2210,26 @@ int sdw_stream_add_slave(struct sdw_slave *slave,
ret = sdw_slave_port_alloc(slave, s_rt, num_ports);
if (ret)
goto alloc_error;
+
+ alloc_slave_port = true;
}
ret = sdw_master_rt_config(m_rt, stream_config);
if (ret)
- goto unlock;
+ goto alloc_error;
ret = sdw_slave_rt_config(s_rt, stream_config);
if (ret)
- goto unlock;
+ goto alloc_error;
ret = sdw_config_stream(&slave->dev, stream, stream_config, true);
if (ret)
- goto unlock;
+ goto alloc_error;
ret = sdw_slave_port_config(slave, s_rt, port_config,
stream->type == SDW_STREAM_BPT);
if (ret)
- goto unlock;
+ goto alloc_error;
/*
* Change stream state to CONFIGURED on first Slave add.
@@ -2231,6 +2246,8 @@ int sdw_stream_add_slave(struct sdw_slave *slave,
* is intentional, the 'master_rt_free' will call sdw_slave_rt_free()
* internally.
*/
+ if (alloc_slave_port)
+ sdw_slave_port_free(slave, stream);
if (alloc_master_rt)
sdw_master_rt_free(m_rt, stream);
else if (alloc_slave_rt)
--
2.56.0.317.g454f8302e1-goog
next prev parent reply other threads:[~2026-10-30 10:50 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-30 10:46 [PATCH 00/21] soundwire: Fix Critical and High issues reported by Sashiko Lee Jones
2026-10-30 10:46 ` [PATCH 01/21] soundwire: bus: Hold bus_lock when looking up slave devices Lee Jones
2026-10-30 10:46 ` [PATCH 02/21] soundwire: sysfs: Use sysfs_emit_at() in array show callbacks Lee Jones
2026-10-30 10:46 ` [PATCH 03/21] soundwire: stream: Prevent m_rt_count underflow in sdw_stream_remove_master() Lee Jones
2026-10-30 11:09 ` sashiko-bot
2026-10-30 10:46 ` Lee Jones [this message]
2026-10-30 10:46 ` [PATCH 05/21] ASoC: SOF: Intel: hda-sdw-bpt: Stop active DMA before closing BPT streams Lee Jones
2026-10-30 10:46 ` [PATCH 06/21] soundwire: intel_ace2x: Protect bus.bpt_stream with bus_lock Lee Jones
2026-10-30 10:46 ` [PATCH 07/21] soundwire: qcom: Prevent pconfig buffer overflow in qcom_swrm_stream_alloc_ports() Lee Jones
2026-10-30 10:46 ` [PATCH 08/21] soundwire: qcom: Disable runtime PM and avoid clock underflow in qcom_swrm_remove() Lee Jones
2026-10-30 10:46 ` [PATCH 09/21] soundwire: qcom: Check clk_prepare_enable() return value Lee Jones
2026-10-30 10:46 ` [PATCH 10/21] soundwire: qcom: Serialise ctrl->intr_mask updates Lee Jones
2026-10-30 10:46 ` [PATCH 11/21] soundwire: qcom: Prevent stale broadcast IRQ from completing subsequent command Lee Jones
2026-10-30 10:46 ` [PATCH 12/21] soundwire: amd: Check for NULL manager drvdata in sdw_amd_startup() Lee Jones
2026-10-30 10:46 ` [PATCH 13/21] soundwire: amd: Check ping command response for timeout Lee Jones
2026-10-30 10:46 ` [PATCH 14/21] soundwire: amd: Preserve lane control bits in amd_sdw_port_enable() Lee Jones
2026-10-30 10:46 ` [PATCH 15/21] soundwire: amd: Avoid static port offset leak in amd_sdw_compute_params() Lee Jones
2026-10-30 10:46 ` [PATCH 16/21] soundwire: amd: Initialise and cancel IRQ work around manager lifetime Lee Jones
2026-10-30 10:46 ` [PATCH 17/21] soundwire: amd: Resume manager before hardware teardown in amd_sdw_manager_remove() Lee Jones
2026-10-30 10:46 ` [PATCH 18/21] soundwire: amd: Synchronise parent IRQ and disable work on manager removal Lee Jones
2026-10-30 10:46 ` [PATCH 19/21] soundwire: amd: Cancel pending work before suspending manager Lee Jones
2026-10-30 10:46 ` [PATCH 20/21] soundwire: amd: Check clock resume timeout in amd_resume_runtime() Lee Jones
2026-10-30 10:47 ` [PATCH 21/21] soundwire: amd: Disable interrupts if enabling manager fails Lee Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261030104840.3361217-5-lee@kernel.org \
--to=lee@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=pierre-louis.bossart@linux.dev \
--cc=rander.wang@intel.com \
--cc=stable@vger.kernel.org \
--cc=vkoul@kernel.org \
--cc=yung-chuan.liao@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox