ASoC: xilinx: formatter_pcm: fix stream_data leak on open error

In xlnx_formatter_pcm_open(), stream_data is allocated and
adata->play_stream or adata->capture_stream is assigned early.  If a
later step, such as snd_pcm_hw_constraint_step() or
snd_pcm_hw_constraint_integer(), fails, the function returns the error
immediately.  ALSA does not call the close callback when open fails, so
stream_data is leaked and the stream pointer is left dangling, pointing
to a substream that ALSA frees.  A later interrupt would then call
snd_pcm_period_elapsed() on the freed substream.

Free stream_data and clear the stream pointer on the error paths.

Fixes: 6f6c3c36f091 ("ASoC: xlnx: add pcm formatter platform driver")
Assisted-by: opencode:deepseek-v4-flash-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Michal Simek <michal.simek@amd.com>
Link: https://patch.msgid.link/20260811185140.27149-1-rosenp@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/xilinx/xlnx_formatter_pcm.c b/sound/soc/xilinx/xlnx_formatter_pcm.c
index 55b5b473d85f9e60d8e1a6bdcc415746cf033512..fce9c0a02ea3488c85fdc8a07f461e0862cea205 100644 (file)
--- a/sound/soc/xilinx/xlnx_formatter_pcm.c
+++ b/sound/soc/xilinx/xlnx_formatter_pcm.c
@@ -384,7 +384,7 @@ static int xlnx_formatter_pcm_open(struct snd_soc_component *component,
        if (err) {
                dev_err(component->dev,
                        "Unable to set constraint on period bytes\n");
-               return err;
+               goto error;
        }
 
        /* Resize the buffer bytes as divisible by 64 */
@@ -394,7 +394,7 @@ static int xlnx_formatter_pcm_open(struct snd_soc_component *component,
        if (err) {
                dev_err(component->dev,
                        "Unable to set constraint on buffer bytes\n");
-               return err;
+               goto error;
        }
 
        /* Set periods as integer multiple */
@@ -403,7 +403,7 @@ static int xlnx_formatter_pcm_open(struct snd_soc_component *component,
        if (err < 0) {
                dev_err(component->dev,
                        "Unable to set constraint on periods to be integer\n");
-               return err;
+               goto error;
        }
 
        /* enable DMA IOC irq */
@@ -412,6 +412,14 @@ static int xlnx_formatter_pcm_open(struct snd_soc_component *component,
        writel(val, stream_data->mmio + XLNX_AUD_CTRL);
 
        return 0;
+
+error:
+       if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+               adata->play_stream = NULL;
+       else
+               adata->capture_stream = NULL;
+       kfree(stream_data);
+       return err;
 }
 
 static int xlnx_formatter_pcm_close(struct snd_soc_component *component,