| Message ID | 20221024122646.1175390-1-yangyingliang@huawei.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | ALSA: hda: fix possible memory leak in azx_codec_configure() | expand |
On Mon, 24 Oct 2022 14:26:46 +0200, Yang Yingliang wrote: > > If the codec device is registered, after calling snd_hdac_device_unregister(), > codec has already been removed from chip bus, it should call put_device() to > give up reference to free codec and device name. > > Fixes: c0f1886de7e1 ("ALSA: hda: intel: Allow repeatedly probing on codec configuration errors") > Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Hrm, are you sure that this will result in a memory leak? put_device() is called at snd_hda_codec_unregister() that is invoked via dev_free callback of the snd_hda_codec object -- which is called when the top-level driver is removed. I'm afraid that your patch will lead to a double-free. thanks, Takashi > --- > sound/pci/hda/hda_controller.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c > index 0ff286b7b66b..f6a73ce300a4 100644 > --- a/sound/pci/hda/hda_controller.c > +++ b/sound/pci/hda/hda_controller.c > @@ -1257,8 +1257,11 @@ int azx_codec_configure(struct azx *chip) > /* unregister failed codecs if any codec has been probed */ > list_for_each_codec_safe(codec, next, &chip->bus) { > if (!codec->configured) { > + bool is_registered = device_is_registered(&codec->core.dev); > codec_err(codec, "Unable to configure, disabling\n"); > snd_hdac_device_unregister(&codec->core); > + if (is_registered) > + put_device(&codec->core.dev); > } > } > } > -- > 2.25.1 >
Hi, On 2022/10/24 22:04, Takashi Iwai wrote: > On Mon, 24 Oct 2022 14:26:46 +0200, > Yang Yingliang wrote: >> If the codec device is registered, after calling snd_hdac_device_unregister(), >> codec has already been removed from chip bus, it should call put_device() to >> give up reference to free codec and device name. >> >> Fixes: c0f1886de7e1 ("ALSA: hda: intel: Allow repeatedly probing on codec configuration errors") >> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> > Hrm, are you sure that this will result in a memory leak? > put_device() is called at snd_hda_codec_unregister() that is invoked > via dev_free callback of the snd_hda_codec object -- which is called > when the top-level driver is removed. I'm afraid that your patch will > lead to a double-free. Thanks for point out. I look deeper, the snd device is add to device list of card, but snd_hdac_device_unregister() is just remove the codec from chip bus, and the snd device still in device list of card, at last each of snd device is freed in snd_device_free_all() with calling snd_hda_codec_dev_free(). Thanks, Yang > > > thanks, > > Takashi > >> --- >> sound/pci/hda/hda_controller.c | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c >> index 0ff286b7b66b..f6a73ce300a4 100644 >> --- a/sound/pci/hda/hda_controller.c >> +++ b/sound/pci/hda/hda_controller.c >> @@ -1257,8 +1257,11 @@ int azx_codec_configure(struct azx *chip) >> /* unregister failed codecs if any codec has been probed */ >> list_for_each_codec_safe(codec, next, &chip->bus) { >> if (!codec->configured) { >> + bool is_registered = device_is_registered(&codec->core.dev); >> codec_err(codec, "Unable to configure, disabling\n"); >> snd_hdac_device_unregister(&codec->core); >> + if (is_registered) >> + put_device(&codec->core.dev); >> } >> } >> } >> -- >> 2.25.1 >> > .
diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c index 0ff286b7b66b..f6a73ce300a4 100644 --- a/sound/pci/hda/hda_controller.c +++ b/sound/pci/hda/hda_controller.c @@ -1257,8 +1257,11 @@ int azx_codec_configure(struct azx *chip) /* unregister failed codecs if any codec has been probed */ list_for_each_codec_safe(codec, next, &chip->bus) { if (!codec->configured) { + bool is_registered = device_is_registered(&codec->core.dev); codec_err(codec, "Unable to configure, disabling\n"); snd_hdac_device_unregister(&codec->core); + if (is_registered) + put_device(&codec->core.dev); } } }
If the codec device is registered, after calling snd_hdac_device_unregister(), codec has already been removed from chip bus, it should call put_device() to give up reference to free codec and device name. Fixes: c0f1886de7e1 ("ALSA: hda: intel: Allow repeatedly probing on codec configuration errors") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- sound/pci/hda/hda_controller.c | 3 +++ 1 file changed, 3 insertions(+)