Hello Ajit Kumar Pandey,

The patch 623621a9f9e1: "ASoC: amd: Add common framework to support I2S on ACP SOC" from Oct 19, 2021, leads to the following Smatch static checker warning:

sound/soc/amd/acp/acp-platform.c:199 acp_dma_open() warn: '&stream->list' not removed from list

sound/soc/amd/acp/acp-platform.c 173 static int acp_dma_open(struct snd_soc_component *component, struct snd_pcm_substream *substream) 174 { 175 struct snd_pcm_runtime *runtime = substream->runtime; 176 struct device *dev = component->dev; 177 struct acp_dev_data *adata = dev_get_drvdata(dev); 178 struct acp_stream *stream; 179 int ret; 180 181 stream = kzalloc(sizeof(*stream), GFP_KERNEL); 182 if (!stream) 183 return -ENOMEM; 184 185 stream->substream = substream; 186 187 spin_lock_irq(&adata->acp_lock); 188 list_add_tail(&stream->list, &adata->stream_list);

Stream added to the list

189 spin_unlock_irq(&adata->acp_lock); 190 191 if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) 192 runtime->hw = acp_pcm_hardware_playback; 193 else 194 runtime->hw = acp_pcm_hardware_capture; 195 196 ret = snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS); 197 if (ret < 0) { 198 dev_err(component->dev, "set integer constraint failed\n"); --> 199 kfree(stream);

Use after free.

200 return ret; 201 } 202 runtime->private_data = stream; 203 204 writel(1, ACP_EXTERNAL_INTR_ENB(adata)); 205 206 return ret;

Could we delay adding the stream to the list until right before this "return 0;"?

207 }

regards, dan carpenter