Dynamic memory referenced by runtime->private_data pointer is allocated in acp6x_pdm_dma_open() and needs to be freed in the corresponding ->close() callback.

unreferenced object 0xffff88813525a940 (size 32): comm "pipewire", pid 1238, jiffies 4294728195 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 3c 03 00 c9 ff ff ..........<..... backtrace (crc 14400236): __kmalloc_cache_noprof+0x3a3/0x490 acp6x_pdm_dma_open+0x10d/0x680 [snd_acp6x_pdm_dma] snd_soc_component_open+0x71/0x150 [snd_soc_core] __soc_pcm_open+0x221/0xb40 [snd_soc_core] soc_pcm_open+0x99/0x110 [snd_soc_core] snd_pcm_open_substream+0x18b/0x4e0 [snd_pcm] snd_pcm_open+0x244/0x670 [snd_pcm] snd_pcm_capture_open+0x72/0xd0 [snd_pcm] chrdev_open+0x1eb/0x5e0 do_dentry_open+0x494/0x1820 vfs_open+0x7a/0x440 do_open+0x3d0/0xd30 path_openat+0x1d3/0x580 do_filp_open+0x1c5/0x450 do_sys_openat2+0xef/0x180 __x64_sys_openat+0x10e/0x210

Found by Linux Verification Center (linuxtesting.org).

Fixes: ceb4fcc13ae5 ("ASoC: amd: add acp6x pdm driver dma ops") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin pchelkin@ispras.ru --- sound/soc/amd/yc/acp6x-pdm-dma.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/sound/soc/amd/yc/acp6x-pdm-dma.c b/sound/soc/amd/yc/acp6x-pdm-dma.c index ac758b90f441..167cd792d33d 100644 --- a/sound/soc/amd/yc/acp6x-pdm-dma.c +++ b/sound/soc/amd/yc/acp6x-pdm-dma.c @@ -275,9 +275,11 @@ static int acp6x_pdm_dma_close(struct snd_soc_component *component, struct snd_pcm_substream *substream) { struct pdm_dev_data *adata = dev_get_drvdata(component->dev); + struct snd_pcm_runtime *runtime = substream->runtime;

acp6x_disable_pdm_interrupts(adata->acp6x_base); adata->capture_stream = NULL; + kfree(runtime->private_data); return 0; }