Hi Jernej

Thank you for your hard work

I found the issue. Commit be7ee5f32a9a ("ASoC: soc-generic-dmaengine-pcm: replace platform to component") changes struct dmaengine_pcm:

struct dmaengine_pcm { struct dma_chan *chan[SNDRV_PCM_STREAM_LAST + 1]; const struct snd_dmaengine_pcm_config *config;

• struct snd_soc_platform platform;

• struct snd_soc_component component; unsigned int flags;

};

In snd_dmaengine_pcm_register(): ret = snd_soc_add_component(dev, &pcm->component, &dmaengine_pcm_component, NULL, 0);

And now, sun4i-codec first time returns -EPROBE_DEFER since driver for analog part is not yet loaded. Because of that, all components get destroyed.

snd_dmaengine_pcm_unregister() calls snd_soc_unregister_component() and that one calls __snd_soc_unregister_component() multiple times (until it fails).

Issue is that __snd_soc_unregister_component() uses kfree() on component pointer and that naturally can't succed since component was never kmalloc'ed since it is a part of a bigger structure - struct dmaengine_pcm.

What would be the best fix? Changing struct dmaengine_pcm to have pointer to a component, so it can be freed?

Ahh.. indeed. Good catch ! How about to add such flag ? This is just idea. No tested, No compiled, but can help you ?

One note here is that reusing "registered_as_component" flag is not good idea, because it will be removed when platform/codec were removed

------------------------ diff --git a/include/sound/soc.h b/include/sound/soc.h index 1a73232..b9b1b4c 100644 --- a/include/sound/soc.h +++ b/include/sound/soc.h @@ -853,6 +853,7 @@ struct snd_soc_component { unsigned int ignore_pmdown_time:1; /* pmdown_time is ignored at stop */ unsigned int registered_as_component:1; unsigned int suspended:1; /* is in suspend PM state */ + unsigned int alloced_component:1;

struct list_head list; struct list_head card_aux_list; /* for auxiliary bound components */ diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index c0edac8..0e33bcf 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -3492,6 +3492,7 @@ int snd_soc_register_component(struct device *dev, if (!component) return -ENOMEM;

+ component->alloced_component = 1; return snd_soc_add_component(dev, component, component_driver, dai_drv, num_dai); } @@ -3523,7 +3524,9 @@ static int __snd_soc_unregister_component(struct device *dev)

if (found) { snd_soc_component_cleanup(component); - kfree(component); + + if (component->alloced_component) + kfree(component); }

return found; ------------------------

Hi,

Dne petek, 09. marec 2018 ob 00:49:18 CET je Kuninori Morimoto napisal(a):

Hi Mark,Jernej

...

...

Ahh.. indeed. Good catch ! How about to add such flag ? This is just idea. No tested, No compiled, but can help you ?

I think this makes sense as a patch. We might want to disallow allocating components as part of a bigger struct so everything is more consistent but that's a bigger thing.

(snip)

...

I tested this patch and there is no crash anymore. If you will send it as a fix, you can add:

Reported-by: Jernej Skrabec jernej.skrabec@siol.net Tested-by: Jernej Skrabec jernej.skrabec@siol.net

previous my patch used new flag (= .alloced_component), but I think it is not good idea. And I noticed that snd_soc_add_component() is also calling kfree(component) (= has same bug).

So how about below one ? I want to post it instead of previous.

# I will go to ELC next week, thus posting patch will be # 2weeks later

---

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index c0edac8..4a8de23 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -3476,7 +3476,6 @@ int snd_soc_add_component(struct device *dev, err_cleanup: snd_soc_component_cleanup(component); err_free:

• kfree(component); return ret;

} EXPORT_SYMBOL_GPL(snd_soc_add_component); @@ -3488,7 +3487,7 @@ int snd_soc_register_component(struct device *dev, { struct snd_soc_component *component;

• component = kzalloc(sizeof(*component), GFP_KERNEL);

• component = devm_kzalloc(dev, sizeof(*component), GFP_KERNEL); if (!component) return -ENOMEM;

@@ -3523,7 +3522,6 @@ static int __snd_soc_unregister_component(struct device *dev)

if (found) { snd_soc_component_cleanup(component);

• kfree(component);
  

  }

  return found;

That patch also prevents the crash, so you can add my tested-by and reported- by tags for this patch too.

Best regards, Jernej

The patch

soc-core: don't call kfree() for component

has been applied to the asoc tree at

https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git

All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying to this mail.

Thanks, Mark

From 7ecbd6a91b1e9bb90a4f3be641669347aacc5ab5 Mon Sep 17 00:00:00 2001

From: Kuninori Morimoto kuninori.morimoto.gx@renesas.com Date: Mon, 19 Mar 2018 07:27:17 +0000 Subject: [PATCH] soc-core: don't call kfree() for component

When driver register its component to ALSA SoC, almost all drivers are using snd_soc_register_component(), but soc-generic-dmaengine-pcm is using snd_soc_add_component().

Existing component function had been assumed that registered component was allocated, and it calling kfree() for it. But, the user who used snd_soc_add_component() doesn't.

This patch uses devm_kzalloc() instead of kzalloc() for component, and doesn't call kree() anymore. This patch fixes commit be7ee5f32a9a ("ASoC: soc-generic-dmaengine-pcm: replace platform to component"). Allwinner H3 SoC will crash without this patch. Thanks Jernej report.

Reported-by: Jernej Skrabec jernej.skrabec@siol.net Signed-off-by: Kuninori Morimoto kuninori.morimoto.gx@renesas.com Tested-by: Jernej Skrabec jernej.skrabec@siol.net Signed-off-by: Mark Brown broonie@kernel.org --- sound/soc/soc-core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index 9558125b448d..8b1ef90f7b57 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -3454,7 +3454,6 @@ int snd_soc_add_component(struct device *dev, err_cleanup: snd_soc_component_cleanup(component); err_free: - kfree(component); return ret; } EXPORT_SYMBOL_GPL(snd_soc_add_component); @@ -3466,7 +3465,7 @@ int snd_soc_register_component(struct device *dev, { struct snd_soc_component *component;

- component = kzalloc(sizeof(*component), GFP_KERNEL); + component = devm_kzalloc(dev, sizeof(*component), GFP_KERNEL); if (!component) return -ENOMEM;

@@ -3501,7 +3500,6 @@ static int __snd_soc_unregister_component(struct device *dev)

if (found) { snd_soc_component_cleanup(component); - kfree(component); }

return found;