Re: [PATCH] ALSA: hda/core: Fix double free on stream page allocation failure

[Takashi Iwai]

On Wed, 28 Oct 2026 15:44:43 +0100,
Sasha Levin wrote:
> 
> Since commit f16eaa38ea64 ("ALSA: hda/core: add cleanup in
> snd_hdac_bus_alloc_stream_pages()"), snd_hdac_bus_alloc_stream_pages()
> frees the BDL and position buffers it has already allocated when a
> later allocation fails.  snd_dma_free_pages() doesn't clear dmab->area,
> so the freed buffers still look allocated to
> snd_hdac_bus_free_stream_pages(), which the HDA controller drivers call
> from their destructors, and they are freed a second time when the
> device is removed.
> 
> With fault injection failing the CORB/RIRB buffer allocation of
> snd-hda-intel on a QEMU ich9-intel-hda, unbinding the device then
> crashes:
> 
>   page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
>   kernel BUG at include/linux/mm.h:1986!
>   Call Trace:
>    ___free_pages+0x9b/0xa0
>    free_pages_exact+0xa5/0xd0
>    snd_hdac_bus_free_stream_pages+0x43/0xb0 [snd_hda_core]
>    azx_free+0xb3/0x1b0 [snd_hda_intel]
>    azx_dev_free+0xd/0x20 [snd_hda_intel]
> 
> Clear the buffer pointers after freeing them in the error path.
> 
> Fixes: f16eaa38ea64 ("ALSA: hda/core: add cleanup in snd_hdac_bus_alloc_stream_pages()")
> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

Applied now.  Thanks.


Takashi