[lvc-project] [PATCH 1/3] ASoC: amd: acp6x-pdm-dma: free pdm device data on closing

[Fedor Pchelkin]

Dynamic memory referenced by runtime->private_data pointer is allocated in
acp6x_pdm_dma_open() and needs to be freed in the corresponding ->close()
callback.

unreferenced object 0xffff88813525a940 (size 32):
  comm "pipewire", pid 1238, jiffies 4294728195
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 3c 03 00 c9 ff ff  ..........<.....
  backtrace (crc 14400236):
    __kmalloc_cache_noprof+0x3a3/0x490
    acp6x_pdm_dma_open+0x10d/0x680 [snd_acp6x_pdm_dma]
    snd_soc_component_open+0x71/0x150 [snd_soc_core]
    __soc_pcm_open+0x221/0xb40 [snd_soc_core]
    soc_pcm_open+0x99/0x110 [snd_soc_core]
    snd_pcm_open_substream+0x18b/0x4e0 [snd_pcm]
    snd_pcm_open+0x244/0x670 [snd_pcm]
    snd_pcm_capture_open+0x72/0xd0 [snd_pcm]
    chrdev_open+0x1eb/0x5e0
    do_dentry_open+0x494/0x1820
    vfs_open+0x7a/0x440
    do_open+0x3d0/0xd30
    path_openat+0x1d3/0x580
    do_filp_open+0x1c5/0x450
    do_sys_openat2+0xef/0x180
    __x64_sys_openat+0x10e/0x210

Found by Linux Verification Center (linuxtesting.org).

Fixes: ceb4fcc13ae5 ("ASoC: amd: add acp6x pdm driver dma ops")
Cc: stable at vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin at ispras.ru>
---
 sound/soc/amd/yc/acp6x-pdm-dma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/amd/yc/acp6x-pdm-dma.c b/sound/soc/amd/yc/acp6x-pdm-dma.c
index ac758b90f441..167cd792d33d 100644
--- a/sound/soc/amd/yc/acp6x-pdm-dma.c
+++ b/sound/soc/amd/yc/acp6x-pdm-dma.c
@@ -275,9 +275,11 @@ static int acp6x_pdm_dma_close(struct snd_soc_component *component,
 			       struct snd_pcm_substream *substream)
 {
 	struct pdm_dev_data *adata = dev_get_drvdata(component->dev);
+	struct snd_pcm_runtime *runtime = substream->runtime;
 
 	acp6x_disable_pdm_interrupts(adata->acp6x_base);
 	adata->capture_stream = NULL;
+	kfree(runtime->private_data);
 	return 0;
 }
 
-- 
2.49.0