Re: [PATCH] ASoC: soc-core: reset rtd->num_components after allocation

[Kees Cook]

On November 9, 2026 3:07:33 AM PST, Takashi Iwai <tiwai@xxxxxxx> wrote:
>On Mon, 09 Nov 2026 11:25:20 +0100,
>Emanuele Ghidoli wrote:
>On Mon, 09 Nov 2026 11:25:20 +0100,
>Emanuele Ghidoli wrote:
>> 
>> From: Emanuele Ghidoli <emanuele.ghidoli@xxxxxxxxxxx>
>> 
>> 
>> Commit 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the
>> devm_kmalloc_obj() family") switched the snd_soc_pcm_runtime allocation
>> in soc_new_pcm_runtime() to devm_kzalloc_flex(). components[] is
>> annotated with __counted_by(num_components), so when the compiler
>> provides __builtin_counted_by_ref() the allocation now also sets
>> rtd->num_components to the number of allocated slots.
>> 
>> snd_soc_rtd_add_component() fills components[] one entry at a time and
>> expects num_components to start at zero. Starting from the allocated
>> size, for_each_rtd_components() stops at the first, still NULL, entry,
>> so the runtime has no components: they are not probed, no controls or
>> user-visible PCM devices are created and the card registers empty,
>> without any error message. In addition, each added component is stored
>> past the end of components[]. On the tested board these stores still
>> land in the slack of the kmalloc bucket that devres rounds the
>> allocation up to, so KASAN does not report them.
>> 
>> Reset num_components after the allocation.
>> 
>> Seen on a Colibri iMX7D (simple-audio-card, fsl-sai, sgtl5000): the card
>> is listed in /proc/asound/cards, but /proc/asound/pcm is empty and
>> 
>>   amixer: Unable to find simple control 'Capture Mux',0
>>   aplay: main:850: audio open error: No such file or directory
>> 
>> Tested on that board with v7.4-rc2 built with GCC 15.2 (first seen with
>> GCC 16.2): the failure is there without this change; with it, playback,
>> capture and the codec controls work again.
>> 
>> The root cause analysis, this change and the testing were done with the
>> help of an AI coding assistant (Claude Code, Claude Opus 5.5).
>> 
>> Fixes: 4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
>> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@xxxxxxxxxxx>
>> ---
>> 4dd10fbbeb9c only reached mainline in v7.4-rc2 (not in broonie/sound yet),
>> so this is based on v7.4-rc2.
>> 
>> The other devm_k[mz]alloc_flex() sites added by 4dd10fbbeb9c were checked
>> too: none of them fills a __counted_by() counter one entry at a time, so
>> this one looks like the only user hit by the preset counter.

Aggh, sorry for the problem, and thanks for checking the other cases.

>
>I guess a bugzilla entry that was reported recently is also related
>with this problem.
>  https://bugzilla.kernel.org/show_bug.cgi?id=222249
>
>My first gut feeling was that it might be safer to revert the use of
>devm_kmalloc_flex() in that code, as it has a significant side-effect
>unlike other straight conversions.  But, if this fix covers well, we
>can go with this fix, of course.

The problem is the annotation, IMO, as the counter member doesn't track allocation size, it tracks usage.


-- 
Kees Cook