Patch "ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     asoc-wm_adsp-fix-memleak-in-wm_adsp_buffer_populate.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 69478893a9679043b71d7ecfe8e7f6b8c513df17
Author: Dinghao Liu <dinghao.liu@xxxxxxxxxx>
Date:   Mon Dec 4 15:41:56 2023 +0800

    ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate
    
    [ Upstream commit 29046a78a3c0a1f8fa0427f164caa222f003cf5b ]
    
    When wm_adsp_buffer_read() fails, we should free buf->regions.
    Otherwise, the callers of wm_adsp_buffer_populate() will
    directly free buf on failure, which makes buf->regions a leaked
    memory.
    
    Fixes: a792af69b08f ("ASoC: wm_adsp: Refactor compress stream initialisation")
    Signed-off-by: Dinghao Liu <dinghao.liu@xxxxxxxxxx>
    Reviewed-by: Richard Fitzgerald <rf@xxxxxxxxxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20231204074158.12026-1-dinghao.liu@xxxxxxxxxx
    Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index d1b9238d391e8..cb654f1b09f10 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1451,12 +1451,12 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf)
 		ret = wm_adsp_buffer_read(buf, caps->region_defs[i].base_offset,
 					  &region->base_addr);
 		if (ret < 0)
-			return ret;
+			goto err;
 
 		ret = wm_adsp_buffer_read(buf, caps->region_defs[i].size_offset,
 					  &offset);
 		if (ret < 0)
-			return ret;
+			goto err;
 
 		region->cumulative_size = offset;
 
@@ -1467,6 +1467,10 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf)
 	}
 
 	return 0;
+
+err:
+	kfree(buf->regions);
+	return ret;
 }
 
 static void wm_adsp_buffer_clear(struct wm_adsp_compr_buf *buf)