From: Kuninori Morimoto <kuninori.morimoto.gx@xxxxxxxxxxx>
[ Upstream commit 2b4ce994afca0690ab79b7860045e6883e8706db ]
Current graph_util_parse_dai() has 2 issue for dlc->xxx handling.
1) dlc->xxx might be filled if snd_soc_get_dai_via_args() (A) works.
In such case it will fill dlc->xxx first (B), and detect error
after that (C). We need to fill dlc->xxx in success case only.
(A) dai = snd_soc_get_dai_via_args(&args);
if (dai) {
ret = -ENOMEM;
^ dlc->of_node = ...
(B) dlc->dai_name = ...
v dlc->dai_args = ...
(C) if (!dlc->dai_args)
goto end;
...
}
2) graph_util_parse_dai() itself has 2 patterns (X)(Y) to fill dlc->xxx.
Both case, we need to call of_node_put(node) (Z) in error case, but we
are calling it only in (Y) case.
int graph_util_parse_dai(...)
{
...
dai = snd_soc_get_dai_via_args(&args);
if (dai) {
...
^ dlc->of_node = ...
(X) dlc->dai_name = ...
v dlc->dai_args = ...
...
}
...
(Y) ret = snd_soc_get_dlc(&args, dlc);
if (ret < 0) {
(Z) of_node_put(node);
...
}
...
}
This patch fixup both case. Make it easy to understand, update
lavel "end" to "err", too.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@xxxxxxxxxxx>
Link: https://patch.msgid.link/87fribr2ns.wl-kuninori.morimoto.gx@xxxxxxxxxxx
Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
**YES** - This commit should be backported to stable kernel trees. The
commit fixes two clear bugs in `graph_util_parse_dai()` error handling:
(1) premature assignment of `dlc->xxx` fields before error validation,
causing inconsistent state when `snd_soc_copy_dai_args()` fails, and (2)
missing `of_node_put(node)` cleanup in error paths, causing device tree
node reference leaks. These are important resource management fixes that
prevent memory leaks and state corruption in ASoC sound card
initialization, with minimal regression risk since only error paths are
modified.
sound/soc/generic/simple-card-utils.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c
index 3ae2a212a2e38..355f7ec8943c2 100644
--- a/sound/soc/generic/simple-card-utils.c
+++ b/sound/soc/generic/simple-card-utils.c
@@ -1119,12 +1119,16 @@ int graph_util_parse_dai(struct simple_util_priv *priv, struct device_node *ep,
args.np = ep;
dai = snd_soc_get_dai_via_args(&args);
if (dai) {
+ const char *dai_name = snd_soc_dai_name_get(dai);
+ const struct of_phandle_args *dai_args = snd_soc_copy_dai_args(dev, &args);
+
ret = -ENOMEM;
+ if (!dai_args)
+ goto err;
+
dlc->of_node = node;
- dlc->dai_name = snd_soc_dai_name_get(dai);
- dlc->dai_args = snd_soc_copy_dai_args(dev, &args);
- if (!dlc->dai_args)
- goto end;
+ dlc->dai_name = dai_name;
+ dlc->dai_args = dai_args;
goto parse_dai_end;
}
@@ -1154,16 +1158,17 @@ int graph_util_parse_dai(struct simple_util_priv *priv, struct device_node *ep,
* if he unbinded CPU or Codec.
*/
ret = snd_soc_get_dlc(&args, dlc);
- if (ret < 0) {
- of_node_put(node);
- goto end;
- }
+ if (ret < 0)
+ goto err;
parse_dai_end:
if (is_single_link)
*is_single_link = of_graph_get_endpoint_count(node) == 1;
ret = 0;
-end:
+err:
+ if (ret < 0)
+ of_node_put(node);
+
return simple_ret(priv, ret);
}
EXPORT_SYMBOL_GPL(graph_util_parse_dai);
--
2.39.5
