Hello Kuninori Morimoto,
Commit c3a15c92a67b ("ASoC: audio-graph-card2: add Codec2Codec
support") from Oct 12, 2021 (linux-next), leads to the following
Smatch static checker warning:
sound/soc/generic/audio-graph-card2.c:1206 graph_count_c2c()
warn: already decremented on line 1206 'lnk->kobj.kref.refcount.refs.counter'
sound/soc/generic/audio-graph-card2.c
1194 static int graph_count_c2c(struct simple_util_priv *priv,
1195 struct device_node *lnk,
1196 struct link_info *li)
1197 {
1198 struct device_node *ports = of_get_parent(lnk);
1199 struct device_node *port0 = lnk;
1200 struct device_node *port1 = of_get_next_child(ports, lnk);
^^^
This calls of_node_put() on lnk.
1201 struct device_node *ep0 = port_to_endpoint(port0);
1202 struct device_node *ep1 = port_to_endpoint(port1);
1203 struct device_node *codec0 = of_graph_get_remote_port(ep0);
1204 struct device_node *codec1 = of_graph_get_remote_port(ep1);
1205
--> 1206 of_node_get(lnk);
So this of_node_get() undoes the put. But if the reference count
dropped to zero then this would be a use afer free.
1207
1208 /*
1209 * codec2codec {
1210 * ports {
1211 * => lnk: port@0 { endpoint { ... }; };
1212 * port@1 { endpoint { ... }; };
1213 * };
1214 * };
1215 */
1216 /*
1217 * DON'T REMOVE platforms
1218 * see
1219 * simple-card.c :: simple_count_noml()
1220 */
1221 li->num[li->link].cpus =
1222 li->num[li->link].platforms = graph_counter(codec0);
1223
1224 li->num[li->link].codecs = graph_counter(codec1);
1225
1226 of_node_put(ports);
1227 of_node_put(port1);
1228 of_node_put(ep0);
1229 of_node_put(ep1);
1230 of_node_put(codec0);
1231 of_node_put(codec1);
1232
1233 return 0;
1234 }
regards,
dan carpenter
[Index of Archives]
[Pulseaudio]
[Linux Audio Users]
[ALSA Devel]
[Fedora Desktop]
[Fedora SELinux]
[Big List of Linux Books]
[Yosemite News]
[KDE Users]