ASoC: stm32: sai: fix OF node leak on probe

commit 23261f0de09427367e99f39f588e31e2856a690e upstream.

The reference taken to the sync provider OF node when probing the
platform device is currently only dropped if the set_sync() callback
fails during DAI probe.

Make sure to drop the reference on platform probe failures (e.g. probe
deferral) and on driver unbind.

This also avoids a potential use-after-free in case the DAI is ever
reprobed without first rebinding the platform driver.

Fixes: 5914d285f6b7 ("ASoC: stm32: sai: Add synchronization support")
Fixes: d4180b4c02e7 ("ASoC: stm32: sai: fix set_sync service")
Cc: Olivier Moysan <olivier.moysan@st.com>
Cc: stable@vger.kernel.org      # 4.16: d4180b4c02e7
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: olivier moysan <olivier.moysan@foss.st.com>
Link: https://patch.msgid.link/20251124104908.15754-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/sound/soc/stm/stm32_sai.c b/sound/soc/stm/stm32_sai.c
index 5721c1bbeb2ff337999c0f8ccc978928d1ca02b0..c46e09a568c599b8d0803578188e40b96e5c2fcf 100644 (file)
--- a/sound/soc/stm/stm32_sai.c
+++ b/sound/soc/stm/stm32_sai.c
@@ -122,7 +122,6 @@ static int stm32_sai_set_sync(struct stm32_sai_data *sai_client,
        if (!pdev) {
                dev_err(&sai_client->pdev->dev,
                        "Device not found for node %pOFn\n", np_provider);
-               of_node_put(np_provider);
                return -ENODEV;
        }
 
@@ -131,21 +130,16 @@ static int stm32_sai_set_sync(struct stm32_sai_data *sai_client,
        if (!sai_provider) {
                dev_err(&sai_client->pdev->dev,
                        "SAI sync provider data not found\n");
-               ret = -EINVAL;
-               goto error;
+               return -EINVAL;
        }
 
        /* Configure sync client */
        ret = stm32_sai_sync_conf_client(sai_client, synci);
        if (ret < 0)
-               goto error;
+               return ret;
 
        /* Configure sync provider */
-       ret = stm32_sai_sync_conf_provider(sai_provider, synco);
-
-error:
-       of_node_put(np_provider);
-       return ret;
+       return stm32_sai_sync_conf_provider(sai_provider, synco);
 }
 
 static int stm32_sai_probe(struct platform_device *pdev)

diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
index 65b3adbaaa0b74dcc7c90989e782e4c9c069f1ad..fb1bd9844b550ff3fc345c973b3d9dd231e56c64 100644 (file)
--- a/sound/soc/stm/stm32_sai_sub.c
+++ b/sound/soc/stm/stm32_sai_sub.c
@@ -1453,7 +1453,8 @@ static int stm32_sai_sub_parse_of(struct platform_device *pdev,
                                dev_err(&pdev->dev,
                                        "External synchro not supported\n");
                                of_node_put(args.np);
-                               return -EINVAL;
+                               ret = -EINVAL;
+                               goto err_put_sync_provider;
                        }
                        sai->sync = SAI_SYNC_EXTERNAL;
 
@@ -1462,7 +1463,8 @@ static int stm32_sai_sub_parse_of(struct platform_device *pdev,
                            (sai->synci > (SAI_GCR_SYNCIN_MAX + 1))) {
                                dev_err(&pdev->dev, "Wrong SAI index\n");
                                of_node_put(args.np);
-                               return -EINVAL;
+                               ret = -EINVAL;
+                               goto err_put_sync_provider;
                        }
 
                        if (of_property_match_string(args.np, "compatible",
@@ -1476,7 +1478,8 @@ static int stm32_sai_sub_parse_of(struct platform_device *pdev,
                        if (!sai->synco) {
                                dev_err(&pdev->dev, "Unknown SAI sub-block\n");
                                of_node_put(args.np);
-                               return -EINVAL;
+                               ret = -EINVAL;
+                               goto err_put_sync_provider;
                        }
                }
 
@@ -1486,13 +1489,15 @@ static int stm32_sai_sub_parse_of(struct platform_device *pdev,
 
        of_node_put(args.np);
        sai->sai_ck = devm_clk_get(&pdev->dev, "sai_ck");
-       if (IS_ERR(sai->sai_ck))
-               return dev_err_probe(&pdev->dev, PTR_ERR(sai->sai_ck),
-                                    "Missing kernel clock sai_ck\n");
+       if (IS_ERR(sai->sai_ck)) {
+               ret = dev_err_probe(&pdev->dev, PTR_ERR(sai->sai_ck),
+                                   "Missing kernel clock sai_ck\n");
+               goto err_put_sync_provider;
+       }
 
        ret = clk_prepare(sai->pdata->pclk);
        if (ret < 0)
-               return ret;
+               goto err_put_sync_provider;
 
        if (STM_SAI_IS_F4(sai->pdata))
                return 0;
@@ -1514,6 +1519,8 @@ static int stm32_sai_sub_parse_of(struct platform_device *pdev,
 
 err_unprepare_pclk:
        clk_unprepare(sai->pdata->pclk);
+err_put_sync_provider:
+       of_node_put(sai->np_sync_provider);
 
        return ret;
 }
@@ -1580,6 +1587,7 @@ static int stm32_sai_sub_probe(struct platform_device *pdev)
 
 err_unprepare_pclk:
        clk_unprepare(sai->pdata->pclk);
+       of_node_put(sai->np_sync_provider);
 
        return ret;
 }
@@ -1592,6 +1600,7 @@ static void stm32_sai_sub_remove(struct platform_device *pdev)
        snd_dmaengine_pcm_unregister(&pdev->dev);
        snd_soc_unregister_component(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
+       of_node_put(sai->np_sync_provider);
 }
 
 #ifdef CONFIG_PM_SLEEP