Skip to contentSkip to conversation

ASoC: mediatek: modify MT2701 AFE driver to adapt mfd device

bug report Dan Carpenter 2 participants 2 messages Jan 22, 2018 Arm MediaTek

lore
Share & tools
lore
#0 lore raw

Hello Ryder Lee,

The patch dfa3cbb83e09: "ASoC: mediatek: modify MT2701 AFE driver to adapt mfd device" from Jan 4, 2018, leads to the following static checker warning:

	sound/soc/mediatek/mt2701/mt2701-afe-pcm.c:1535 mt2701_afe_pcm_dev_probe()
	error: double free of 'component'

sound/soc/mediatek/mt2701/mt2701-afe-pcm.c
1509 pm_runtime_get_sync(dev);
1510
1511 ret = snd_soc_register_platform(dev, &mtk_afe_pcm_platform);
1512 if (ret) {
1513 dev_warn(dev, "err_platform\n");
1514 goto err_platform;
1515 }
1516
1517 ret = snd_soc_add_component(dev, component,

                                                 ^^^^^^^^^

snd_soc_add_component() frees "component" on error. This seems like a layering violation to me, and it naturally leads to bugs like this.

  1518                                      &mt2701_afe_pcm_dai_component,
  1519                                      mt2701_afe_pcm_dais,
  1520                                      ARRAY_SIZE(mt2701_afe_pcm_dais));
  1521          if (ret) {
  1522                  dev_warn(dev, "err_dai_component\n");
  1523                  goto err_dai_component;
  1524          }
  1525  
  1526          return 0;
  1527  
  1528  err_dai_component:
  1529          snd_soc_unregister_platform(dev);
  1530  err_platform:
  1531          pm_runtime_put_sync(dev);
  1532  err_pm_disable:
  1533          pm_runtime_disable(dev);
  1534  err_init_clock:
  1535          kfree(component);
                      ^^^^^^^^^

Double free

1536
1537 return ret;
1538 }

regards,
dan carpenter

#1 lore raw
Quoted 42 lines · Dan Carpenter

Hello Ryder Lee,

The patch dfa3cbb83e09: "ASoC: mediatek: modify MT2701 AFE driver to adapt mfd device" from Jan 4, 2018, leads to the following static checker warning:

	sound/soc/mediatek/mt2701/mt2701-afe-pcm.c:1535 mt2701_afe_pcm_dev_probe()
	error: double free of 'component'

sound/soc/mediatek/mt2701/mt2701-afe-pcm.c
1509 pm_runtime_get_sync(dev);
1510
1511 ret = snd_soc_register_platform(dev, &mtk_afe_pcm_platform);
1512 if (ret) {
1513 dev_warn(dev, "err_platform\n");
1514 goto err_platform;
1515 }
1516
1517 ret = snd_soc_add_component(dev, component,

                                                 ^^^^^^^^^

snd_soc_add_component() frees "component" on error. This seems like a layering violation to me, and it naturally leads to bugs like this.

  1518                                      &mt2701_afe_pcm_dai_component,
  1519                                      mt2701_afe_pcm_dais,
  1520                                      ARRAY_SIZE(mt2701_afe_pcm_dais));
  1521          if (ret) {
  1522                  dev_warn(dev, "err_dai_component\n");
  1523                  goto err_dai_component;
  1524          }
  1525  
  1526          return 0;
  1527  
  1528  err_dai_component:
  1529          snd_soc_unregister_platform(dev);
  1530  err_platform:
  1531          pm_runtime_put_sync(dev);
  1532  err_pm_disable:
  1533          pm_runtime_disable(dev);
  1534  err_init_clock:
  1535          kfree(component);
                      ^^^^^^^^^
Quoted 1 line

Double free

Thanks for catching that. I've just sent a fixup patch.

Ryder