* [PATCH 6.8 regression fix 0/2] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards
@ 2024-02-10 13:43 Hans de Goede
2024-02-10 13:43 ` [PATCH 6.8 regression fix 1/2] " Hans de Goede
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Hans de Goede @ 2024-02-10 13:43 UTC (permalink / raw
To: Cezary Rojewski, Pierre-Louis Bossart, Liam Girdwood,
Peter Ujfalusi, Mark Brown
Cc: Hans de Goede, Oder Chiou, alsa-devel
Hi All,
While testing 6.8 on a Bay Trail device with a ALC5640 codec
I noticed a regression in 6.8 which causes a NULL pointer deref
in probe().
All BYT/CHT Intel machine drivers are affected. Patch 1/2 of
this series fixes all of them.
Patch 2/2 adds some small cleanups to cht_bsw_rt5645.c for
issues which I noticed while working on 1/2.
Regards,
Hans
Hans de Goede (2):
ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards
ASoC: Intel: cht_bsw_rt5645: Cleanup codec_name handling
sound/soc/intel/boards/bytcht_cx2072x.c | 3 ++-
sound/soc/intel/boards/bytcht_da7213.c | 3 ++-
sound/soc/intel/boards/bytcht_es8316.c | 3 ++-
sound/soc/intel/boards/bytcr_rt5640.c | 3 ++-
sound/soc/intel/boards/bytcr_rt5651.c | 3 ++-
sound/soc/intel/boards/bytcr_wm5102.c | 3 ++-
sound/soc/intel/boards/cht_bsw_rt5645.c | 7 +++----
sound/soc/intel/boards/cht_bsw_rt5672.c | 3 ++-
8 files changed, 17 insertions(+), 11 deletions(-)
--
2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 6.8 regression fix 1/2] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards
2024-02-10 13:43 [PATCH 6.8 regression fix 0/2] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards Hans de Goede
@ 2024-02-10 13:43 ` Hans de Goede
2024-02-10 13:44 ` [PATCH 2/2] ASoC: Intel: cht_bsw_rt5645: Cleanup codec_name handling Hans de Goede
2024-02-12 1:55 ` [PATCH 6.8 regression fix 0/2] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards Mark Brown
2 siblings, 0 replies; 4+ messages in thread
From: Hans de Goede @ 2024-02-10 13:43 UTC (permalink / raw
To: Cezary Rojewski, Pierre-Louis Bossart, Liam Girdwood,
Peter Ujfalusi, Mark Brown
Cc: Hans de Goede, Oder Chiou, alsa-devel, Kuninori Morimoto
Since commit 13f58267cda3 ("ASoC: soc.h: don't create dummy Component
via COMP_DUMMY()") dummy snd_soc_dai_link.codecs entries no longer
have a name set.
This means that when looking for the codec dai_link the machine
driver can no longer unconditionally run strcmp() on
snd_soc_dai_link.codecs[0].name since this may now be NULL.
Add a check for snd_soc_dai_link.codecs[0].name being NULL to all
BYT/CHT machine drivers to avoid NULL pointer dereferences in
their probe() methods.
Fixes: 13f58267cda3 ("ASoC: soc.h: don't create dummy Component via COMP_DUMMY()")
Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---
sound/soc/intel/boards/bytcht_cx2072x.c | 3 ++-
sound/soc/intel/boards/bytcht_da7213.c | 3 ++-
sound/soc/intel/boards/bytcht_es8316.c | 3 ++-
sound/soc/intel/boards/bytcr_rt5640.c | 3 ++-
sound/soc/intel/boards/bytcr_rt5651.c | 3 ++-
sound/soc/intel/boards/bytcr_wm5102.c | 3 ++-
sound/soc/intel/boards/cht_bsw_rt5645.c | 3 ++-
sound/soc/intel/boards/cht_bsw_rt5672.c | 3 ++-
8 files changed, 16 insertions(+), 8 deletions(-)
diff --git a/sound/soc/intel/boards/bytcht_cx2072x.c b/sound/soc/intel/boards/bytcht_cx2072x.c
index 10a84a2c1036..c014d85a08b2 100644
--- a/sound/soc/intel/boards/bytcht_cx2072x.c
+++ b/sound/soc/intel/boards/bytcht_cx2072x.c
@@ -241,7 +241,8 @@ static int snd_byt_cht_cx2072x_probe(struct platform_device *pdev)
/* fix index of codec dai */
for (i = 0; i < ARRAY_SIZE(byt_cht_cx2072x_dais); i++) {
- if (!strcmp(byt_cht_cx2072x_dais[i].codecs->name,
+ if (byt_cht_cx2072x_dais[i].codecs->name &&
+ !strcmp(byt_cht_cx2072x_dais[i].codecs->name,
"i2c-14F10720:00")) {
dai_index = i;
break;
diff --git a/sound/soc/intel/boards/bytcht_da7213.c b/sound/soc/intel/boards/bytcht_da7213.c
index 7e5eea690023..f4ac3ddd148b 100644
--- a/sound/soc/intel/boards/bytcht_da7213.c
+++ b/sound/soc/intel/boards/bytcht_da7213.c
@@ -245,7 +245,8 @@ static int bytcht_da7213_probe(struct platform_device *pdev)
/* fix index of codec dai */
for (i = 0; i < ARRAY_SIZE(dailink); i++) {
- if (!strcmp(dailink[i].codecs->name, "i2c-DLGS7213:00")) {
+ if (dailink[i].codecs->name &&
+ !strcmp(dailink[i].codecs->name, "i2c-DLGS7213:00")) {
dai_index = i;
break;
}
diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
index 1564a88a885e..2fcec2e02bb5 100644
--- a/sound/soc/intel/boards/bytcht_es8316.c
+++ b/sound/soc/intel/boards/bytcht_es8316.c
@@ -546,7 +546,8 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)
/* fix index of codec dai */
for (i = 0; i < ARRAY_SIZE(byt_cht_es8316_dais); i++) {
- if (!strcmp(byt_cht_es8316_dais[i].codecs->name,
+ if (byt_cht_es8316_dais[i].codecs->name &&
+ !strcmp(byt_cht_es8316_dais[i].codecs->name,
"i2c-ESSX8316:00")) {
dai_index = i;
break;
diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index 42466b4b1ca4..03be5e26ec4a 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -1652,7 +1652,8 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
/* fix index of codec dai */
for (i = 0; i < ARRAY_SIZE(byt_rt5640_dais); i++) {
- if (!strcmp(byt_rt5640_dais[i].codecs->name,
+ if (byt_rt5640_dais[i].codecs->name &&
+ !strcmp(byt_rt5640_dais[i].codecs->name,
"i2c-10EC5640:00")) {
dai_index = i;
break;
diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
index f9fe8414f454..80c841b000a3 100644
--- a/sound/soc/intel/boards/bytcr_rt5651.c
+++ b/sound/soc/intel/boards/bytcr_rt5651.c
@@ -910,7 +910,8 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev)
/* fix index of codec dai */
for (i = 0; i < ARRAY_SIZE(byt_rt5651_dais); i++) {
- if (!strcmp(byt_rt5651_dais[i].codecs->name,
+ if (byt_rt5651_dais[i].codecs->name &&
+ !strcmp(byt_rt5651_dais[i].codecs->name,
"i2c-10EC5651:00")) {
dai_index = i;
break;
diff --git a/sound/soc/intel/boards/bytcr_wm5102.c b/sound/soc/intel/boards/bytcr_wm5102.c
index 6978ebde6693..cccb5e90c0fe 100644
--- a/sound/soc/intel/boards/bytcr_wm5102.c
+++ b/sound/soc/intel/boards/bytcr_wm5102.c
@@ -605,7 +605,8 @@ static int snd_byt_wm5102_mc_probe(struct platform_device *pdev)
/* find index of codec dai */
for (i = 0; i < ARRAY_SIZE(byt_wm5102_dais); i++) {
- if (!strcmp(byt_wm5102_dais[i].codecs->name,
+ if (byt_wm5102_dais[i].codecs->name &&
+ !strcmp(byt_wm5102_dais[i].codecs->name,
"wm5102-codec")) {
dai_index = i;
break;
diff --git a/sound/soc/intel/boards/cht_bsw_rt5645.c b/sound/soc/intel/boards/cht_bsw_rt5645.c
index c952a96cde7e..7773f61064f4 100644
--- a/sound/soc/intel/boards/cht_bsw_rt5645.c
+++ b/sound/soc/intel/boards/cht_bsw_rt5645.c
@@ -571,7 +571,8 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
/* set correct codec name */
for (i = 0; i < ARRAY_SIZE(cht_dailink); i++)
- if (!strcmp(card->dai_link[i].codecs->name,
+ if (card->dai_link[i].codecs->name &&
+ !strcmp(card->dai_link[i].codecs->name,
"i2c-10EC5645:00")) {
card->dai_link[i].codecs->name = drv->codec_name;
dai_index = i;
diff --git a/sound/soc/intel/boards/cht_bsw_rt5672.c b/sound/soc/intel/boards/cht_bsw_rt5672.c
index 8cf0b33cc02e..be2d1a8dbca8 100644
--- a/sound/soc/intel/boards/cht_bsw_rt5672.c
+++ b/sound/soc/intel/boards/cht_bsw_rt5672.c
@@ -466,7 +466,8 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
/* find index of codec dai */
for (i = 0; i < ARRAY_SIZE(cht_dailink); i++) {
- if (!strcmp(cht_dailink[i].codecs->name, RT5672_I2C_DEFAULT)) {
+ if (cht_dailink[i].codecs->name &&
+ !strcmp(cht_dailink[i].codecs->name, RT5672_I2C_DEFAULT)) {
dai_index = i;
break;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 2/2] ASoC: Intel: cht_bsw_rt5645: Cleanup codec_name handling
2024-02-10 13:43 [PATCH 6.8 regression fix 0/2] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards Hans de Goede
2024-02-10 13:43 ` [PATCH 6.8 regression fix 1/2] " Hans de Goede
@ 2024-02-10 13:44 ` Hans de Goede
2024-02-12 1:55 ` [PATCH 6.8 regression fix 0/2] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards Mark Brown
2 siblings, 0 replies; 4+ messages in thread
From: Hans de Goede @ 2024-02-10 13:44 UTC (permalink / raw
To: Cezary Rojewski, Pierre-Louis Bossart, Liam Girdwood,
Peter Ujfalusi, Mark Brown
Cc: Hans de Goede, Oder Chiou, alsa-devel
4 fixes / cleanups to the rt5645 mc driver's codec_name handling:
1. In the for loop looking for the dai_index for the codec, replace
card->dai_link[i] with cht_dailink[i]. The for loop already uses
ARRAY_SIZE(cht_dailink) as bound and card->dai_link is just a pointer to
cht_dailink using card->dai_link only obfuscates that cht_dailink is being
modified directly rather then say a copy of cht_dailink. Using
cht_dailink[i] also makes the code consistent with other machine drivers.
2. Don't set cht_dailink[dai_index].codecs->name in the for loop,
this immediately gets overridden using acpi_dev_name(adev) directly
below the loop.
3. Add a missing break to the loop.
4. Remove the now no longer used (only set, never read) codec_name field
from struct cht_mc_private.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---
sound/soc/intel/boards/cht_bsw_rt5645.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/sound/soc/intel/boards/cht_bsw_rt5645.c b/sound/soc/intel/boards/cht_bsw_rt5645.c
index 7773f61064f4..eb41b7115d01 100644
--- a/sound/soc/intel/boards/cht_bsw_rt5645.c
+++ b/sound/soc/intel/boards/cht_bsw_rt5645.c
@@ -40,7 +40,6 @@ struct cht_acpi_card {
struct cht_mc_private {
struct snd_soc_jack jack;
struct cht_acpi_card *acpi_card;
- char codec_name[SND_ACPI_I2C_ID_LEN];
struct clk *mclk;
};
@@ -567,15 +566,14 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
}
card->dev = &pdev->dev;
- sprintf(drv->codec_name, "i2c-%s:00", drv->acpi_card->codec_id);
/* set correct codec name */
for (i = 0; i < ARRAY_SIZE(cht_dailink); i++)
- if (card->dai_link[i].codecs->name &&
- !strcmp(card->dai_link[i].codecs->name,
+ if (cht_dailink[i].codecs->name &&
+ !strcmp(cht_dailink[i].codecs->name,
"i2c-10EC5645:00")) {
- card->dai_link[i].codecs->name = drv->codec_name;
dai_index = i;
+ break;
}
/* fixup codec name based on HID */
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 6.8 regression fix 0/2] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards
2024-02-10 13:43 [PATCH 6.8 regression fix 0/2] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards Hans de Goede
2024-02-10 13:43 ` [PATCH 6.8 regression fix 1/2] " Hans de Goede
2024-02-10 13:44 ` [PATCH 2/2] ASoC: Intel: cht_bsw_rt5645: Cleanup codec_name handling Hans de Goede
@ 2024-02-12 1:55 ` Mark Brown
2 siblings, 0 replies; 4+ messages in thread
From: Mark Brown @ 2024-02-12 1:55 UTC (permalink / raw
To: Cezary Rojewski, Pierre-Louis Bossart, Liam Girdwood,
Peter Ujfalusi, Hans de Goede
Cc: Oder Chiou, alsa-devel
On Sat, 10 Feb 2024 14:43:58 +0100, Hans de Goede wrote:
> While testing 6.8 on a Bay Trail device with a ALC5640 codec
> I noticed a regression in 6.8 which causes a NULL pointer deref
> in probe().
>
> All BYT/CHT Intel machine drivers are affected. Patch 1/2 of
> this series fixes all of them.
>
> [...]
Applied to
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next
Thanks!
[1/2] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards
commit: 7d99a70b65951108d82e1618c67abe69c3ed7720
[2/2] ASoC: Intel: cht_bsw_rt5645: Cleanup codec_name handling
commit: 930375d34de67e129566caca008de0bbc54a4646
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-02-12 1:56 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-02-10 13:43 [PATCH 6.8 regression fix 0/2] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards Hans de Goede
2024-02-10 13:43 ` [PATCH 6.8 regression fix 1/2] " Hans de Goede
2024-02-10 13:44 ` [PATCH 2/2] ASoC: Intel: cht_bsw_rt5645: Cleanup codec_name handling Hans de Goede
2024-02-12 1:55 ` [PATCH 6.8 regression fix 0/2] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards Mark Brown
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.