Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Takashi Iwai]

On Mon, 09 Nov 2026 12:07:33 +0100,
Takashi Iwai wrote:
> 
> On Mon, 09 Nov 2026 11:25:20 +0100,
> Emanuele Ghidoli wrote:
> On Mon, 09 Nov 2026 11:25:20 +0100,
> Emanuele Ghidoli wrote:
> > 
> > From: Emanuele Ghidoli <emanuele.ghidoli@xxxxxxxxxxx>
> > 
> > 
> > Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
> > devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
> > in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
> > annotated with __counted_by(num_components), so when the compiler
> > provides __builtin_counted_by_ref() the allocation now also sets
> > rtd->num_components to the number of allocated slots.
> > 
> > snd_soc_rtd_add_component() fills components[] one entry at a time and
> > expects num_components to start at zero. Starting from the allocated
> > size, for_each_rtd_components() stops at the first, still NULL, entry,
> > so the runtime has no components: they are not probed, no controls or
> > user-visible PCM devices are created and the card registers empty,
> > without any error message. In addition, each added component is stored
> > past the end of components[]. On the tested board these stores still
> > land in the slack of the kmalloc bucket that devres rounds the
> > allocation up to, so KASAN does not report them.
> > 
> > Reset num_components after the allocation.
> > 
> > Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
> > is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
> > 
> >   amixer: Unable to find simple control 'Capture Mux',0
> >   aplay: main:850: audio open error: No such file or directory
> > 
> > Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
> > GCC 16.2): the failure is there without this change; with it, playback,
> > capture and the codec controls work again.
> > 
> > The root cause analysis, this change and the testing were done with the
> > help of an AI coding assistant (Claude Code, Claude Opus 5.5).
> > 
> > Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
> > Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@xxxxxxxxxxx>
> > ---
> > 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
> > so this is based on v7.4-rc2.
> > 
> > The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
> > too: none of them fills a __counted_by() counter one entry at a time, so
> > this one looks like the only user hit by the preset counter.
> 
> I guess a bugzilla entry that was reported recently is also related
> with this problem.
>   https://bugzilla.kernel.org/show_bug.cgi?id=222249
> 
> My first gut feeling was that it might be safer to revert the use of
> devm_kmalloc_flex() in that code, as it has a significant side-effect
> unlike other straight conversions.  But, if this fix covers well, we
> can go with this fix, of course.

And it seems working for the bugzilla issue above, too.

Mark, could you pick this up quickly?  It looks like a severe
regression.

Reviewed-by: Takashi Iwai <tiwai@xxxxxxx>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=222249


thanks,

Takashi