Re: [PATCH v2] ASoC: qdsp6: q6routing: Fix memory leak on probe failure

[Srinivas Kandagatla]

On 10/28/26 1:57 AM, Tang Bin wrote:
> routing_data is allocated with kzalloc() and stored in a global static
> pointer. If devm_snd_soc_register_component() fails, the probe function
> returns directly without freeing routing_data. Since the remove callback
> is not invoked on probe failure, this leads to a memory leak. On a probe
> retry, a new routing_data overwrites the global pointer, permanently
> losing the previous allocation.
> 
> Fix this by switching to devm_kzalloc_obj() for the allocation. This
> ensures the memory is automatically freed by the device core if probe
> fails or when the driver is unbound. Consequently, the manual kfree()
> in the remove callback is no longer needed and must be removed to avoid
> a double-free.
> 
> Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver")
> Signed-off-by: Tang Bin <tangbin@xxxxxxxxxxxxxxxxxxxx>
> ---
lgtm,

Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@xxxxxxxxxxxxxxxx>

--Srini

> Changes in v2:
> - Use devm_kzalloc_obj() to let the device core manage the memory
>   lifecycle, as suggested by Srinivas Kandagatla. This eliminates the
>   need for manual error handling and prevents a double-free in remove.
> 
>  sound/soc/qcom/qdsp6/q6routing.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
> index d076c99f1..4816d4b9a 100644
> --- a/sound/soc/qcom/qdsp6/q6routing.c
> +++ b/sound/soc/qcom/qdsp6/q6routing.c
> @@ -1209,7 +1209,7 @@ static int q6pcm_routing_probe(struct platform_device *pdev)
>  {
>  	struct device *dev = &pdev->dev;
>  
> -	routing_data = kzalloc_obj(*routing_data);
> +	routing_data = devm_kzalloc_obj(dev, *routing_data);
>  	if (!routing_data)
>  		return -ENOMEM;
>  
> @@ -1224,7 +1224,6 @@ static int q6pcm_routing_probe(struct platform_device *pdev)
>  
>  static void q6pcm_routing_remove(struct platform_device *pdev)
>  {
> -	kfree(routing_data);
>  	routing_data = NULL;
>  }
>