All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Nícolas F. R. A. Prado" <nfraprado@collabora.com>
To: Mark Brown <broonie@kernel.org>
Cc: "AngeloGioacchino Del Regno"
	<angelogioacchino.delregno@collabora.com>,
	kernel@collabora.com,
	"Nícolas F. R. A. Prado" <nfraprado@collabora.com>,
	"Jaroslav Kysela" <perex@perex.cz>,
	"Kuninori Morimoto" <kuninori.morimoto.gx@renesas.com>,
	"Liam Girdwood" <lgirdwood@gmail.com>,
	"Matthias Brugger" <matthias.bgg@gmail.com>,
	"Nícolas F. R. A. Prado via Alsa-devel"
	<alsa-devel@alsa-project.org>, "Rob Herring" <robh@kernel.org>,
	"Takashi Iwai" <tiwai@suse.com>,
	linux-arm-kernel@lists.infradead.org,
	linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org,
	linux-sound@vger.kernel.org
Subject: [PATCH] ASoC: mediatek: mt8192: Check existence of dai_name before dereferencing
Date: Mon,  8 Jan 2024 17:44:58 -0300	[thread overview]
Message-ID: <20240108204508.691739-1-nfraprado@collabora.com> (raw)

Following commit 13f58267cda3 ("ASoC: soc.h: don't create dummy
Component via COMP_DUMMY()"), the dai_name field is only populated for
dummy components after the card is registered. This causes a null
pointer dereference in the mt8192-mt6359 sound card driver's probe
function when searching for a dai_name among all the card's dai links.

Verify that the dai_name is non-null before passing it to strcmp. While
at it, also check that there's at least one codec.

Reported-by: "kernelci.org bot" <bot@kernelci.org>
Closes: https://linux.kernelci.org/test/case/id/6582cd6d992645c680e13478/
Fixes: 13f58267cda3 ("ASoC: soc.h: don't create dummy Component via COMP_DUMMY()")
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>

---

 sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
index 5bd6addd1450..bfcb2c486c39 100644
--- a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+++ b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
@@ -1208,7 +1208,8 @@ static int mt8192_mt6359_dev_probe(struct platform_device *pdev)
 			dai_link->ignore = 0;
 		}
 
-		if (strcmp(dai_link->codecs[0].dai_name, RT1015_CODEC_DAI) == 0)
+		if (dai_link->num_codecs && dai_link->codecs[0].dai_name &&
+		    strcmp(dai_link->codecs[0].dai_name, RT1015_CODEC_DAI) == 0)
 			dai_link->ops = &mt8192_rt1015_i2s_ops;
 
 		if (!dai_link->platforms->name)
-- 
2.43.0


WARNING: multiple messages have this Message-ID (diff)
From: "Nícolas F. R. A. Prado" <nfraprado@collabora.com>
To: Mark Brown <broonie@kernel.org>
Cc: "AngeloGioacchino Del Regno"
	<angelogioacchino.delregno@collabora.com>,
	kernel@collabora.com,
	"Nícolas F. R. A. Prado" <nfraprado@collabora.com>,
	"Jaroslav Kysela" <perex@perex.cz>,
	"Kuninori Morimoto" <kuninori.morimoto.gx@renesas.com>,
	"Liam Girdwood" <lgirdwood@gmail.com>,
	"Matthias Brugger" <matthias.bgg@gmail.com>,
	"Nícolas F. R. A. Prado via Alsa-devel"
	<alsa-devel@alsa-project.org>, "Rob Herring" <robh@kernel.org>,
	"Takashi Iwai" <tiwai@suse.com>,
	linux-arm-kernel@lists.infradead.org,
	linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org,
	linux-sound@vger.kernel.org
Subject: [PATCH] ASoC: mediatek: mt8192: Check existence of dai_name before dereferencing
Date: Mon,  8 Jan 2024 17:44:58 -0300	[thread overview]
Message-ID: <20240108204508.691739-1-nfraprado@collabora.com> (raw)

Following commit 13f58267cda3 ("ASoC: soc.h: don't create dummy
Component via COMP_DUMMY()"), the dai_name field is only populated for
dummy components after the card is registered. This causes a null
pointer dereference in the mt8192-mt6359 sound card driver's probe
function when searching for a dai_name among all the card's dai links.

Verify that the dai_name is non-null before passing it to strcmp. While
at it, also check that there's at least one codec.

Reported-by: "kernelci.org bot" <bot@kernelci.org>
Closes: https://linux.kernelci.org/test/case/id/6582cd6d992645c680e13478/
Fixes: 13f58267cda3 ("ASoC: soc.h: don't create dummy Component via COMP_DUMMY()")
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>

---

 sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
index 5bd6addd1450..bfcb2c486c39 100644
--- a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+++ b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
@@ -1208,7 +1208,8 @@ static int mt8192_mt6359_dev_probe(struct platform_device *pdev)
 			dai_link->ignore = 0;
 		}
 
-		if (strcmp(dai_link->codecs[0].dai_name, RT1015_CODEC_DAI) == 0)
+		if (dai_link->num_codecs && dai_link->codecs[0].dai_name &&
+		    strcmp(dai_link->codecs[0].dai_name, RT1015_CODEC_DAI) == 0)
 			dai_link->ops = &mt8192_rt1015_i2s_ops;
 
 		if (!dai_link->platforms->name)
-- 
2.43.0


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

             reply	other threads:[~2024-01-08 20:47 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-01-08 20:44 Nícolas F. R. A. Prado [this message]
2024-01-08 20:44 ` [PATCH] ASoC: mediatek: mt8192: Check existence of dai_name before dereferencing Nícolas F. R. A. Prado
2024-01-09  3:44 ` Chen-Yu Tsai
2024-01-09  3:44   ` Chen-Yu Tsai
2024-01-09  9:53 ` Mark Brown
2024-01-09  9:53   ` Mark Brown

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240108204508.691739-1-nfraprado@collabora.com \
    --to=nfraprado@collabora.com \
    --cc=alsa-devel@alsa-project.org \
    --cc=angelogioacchino.delregno@collabora.com \
    --cc=broonie@kernel.org \
    --cc=kernel@collabora.com \
    --cc=kuninori.morimoto.gx@renesas.com \
    --cc=lgirdwood@gmail.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mediatek@lists.infradead.org \
    --cc=linux-sound@vger.kernel.org \
    --cc=matthias.bgg@gmail.com \
    --cc=perex@perex.cz \
    --cc=robh@kernel.org \
    --cc=tiwai@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.