From 053be1dd25dd30d1b536a62df9676d5ff4653550 Mon Sep 17 00:00:00 2001 From: Kai Vehmanen Date: Wed, 11 Nov 2026 13:01:00 +0200 Subject: [PATCH] ipc4: chain_dma: free the component container from its own heap The chain DMA error path freed the ipc_comp_dev with rfree(). Since commit 85feda101c6e ("ipc: allocate IPC objects from the user-accessible system heap"), ipc4_add_comp_dev() allocates it with sof_heap_alloc() from sof_sys_user_heap_get(). With CONFIG_SOF_USERSPACE_LL that is the LL user heap, a block inside the kernel heap, so rfree() put the chunk into the kernel heap and corrupted it. Free it with sof_heap_free() from the same heap, as the other ipc_comp_dev free paths do. Fixes: 85feda101c6e ("ipc: allocate IPC objects from the user-accessible system heap") Signed-off-by: Kai Vehmanen --- src/ipc/ipc4/handler-user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ipc/ipc4/handler-user.c b/src/ipc/ipc4/handler-user.c index 0af33fe7fd1c..167639253152 100644 --- a/src/ipc/ipc4/handler-user.c +++ b/src/ipc/ipc4/handler-user.c @@ -736,7 +736,7 @@ __cold static int ipc4_process_chain_dma(struct ipc4_message_request *ipc4) if (ret < 0) { comp_free(cdma_comp->cd); list_item_del(&cdma_comp->list); - rfree(cdma_comp); + sof_heap_free(sof_sys_user_heap_get(), cdma_comp); return IPC4_FAILURE; }