Re: [PATCH] ASoC: soc-core: start rtd->num_components at zero

[Kees Cook]

On Thu, Nov 12, 2026 at 02:34:17PM +0100, Hans de Goede wrote:
> @Kees, have you seen Dennis' remark about the same problem with
> devm_kzalloc_flex() changing the semantics with the num-components
> counter now no longer being initialized to zero in at least 2 other
> places? :

Eek, thank you. I will go look at these!

> 
> """
> Kees, the same pattern (a *_flex() allocation followed by code that uses
> the counter as a fill index starting from zero) looks to be present in
> two places converted by 69050f8d6d07 ("treewide: Replace kmalloc with
> kmalloc_obj for non-scalar types"). I have only read the code for these.
> I have no hardware for either and have not reproduced them, so please
> treat them as possible issues rather than confirmed bugs:
> 
>  - drivers/spi/spi-axi-spi-engine.c: spi_engine_optimize_message()
>    allocates p with kzalloc_flex(*p, instructions, p_dry.length + 1),
>    which presets p->length, and spi_engine_compile_message() then
>    appends with p->length++ through spi_engine_program_add_cmd().

Oh, this was from before:
69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types")

>  - drivers/net/wireless/intel/iwlwifi/mld/d3.c:
>    iwl_mld_process_netdetect_res() allocates netdetect_info with
>    kzalloc_flex(..., matches, n_matches), presetting n_matches, and
>    iwl_mld_set_netdetect_info() stores at matches[n_matches] and then
>    increments it. The per-match kzalloc_flex(..., channels, n_channels)
>    has the same issue with match->n_channels.

Same.

I'll send fixes.

-- 
Kees Cook