ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder

Since commit 13f58267cda3 ("ASoC: soc.h: don't create dummy Component
via COMP_DUMMY()") dummy codecs declared like this:

SND_SOC_DAILINK_DEF(dummy,
        DAILINK_COMP_ARRAY(COMP_DUMMY()));

expand to:

static struct snd_soc_dai_link_component dummy[] = {
};

Which means that dummy is a zero sized array and thus dais[i].codecs should
not be dereferenced *at all* since it points to the address of the next
variable stored in the data section as the "dummy" variable has an address
but no size, so even dereferencing dais[0] is already an out of bounds
array reference.

Which means that the if (dais[i].codecs->name) check added in
commit 7d99a70b6595 ("ASoC: Intel: Boards: Fix NULL pointer deref
in BYT/CHT boards") relies on that the part of the next variable which
the name member maps to just happens to be NULL.

Which apparently so far it usually is, except when it isn't
and then it results in crashes like this one:

[   28.795659] BUG: unable to handle page fault for address: 0000000000030011
...
[   28.795780] Call Trace:
[   28.795787]  <TASK>
...
[   28.795862]  ? strcmp+0x18/0x40
[   28.795872]  0xffffffffc150c605
[   28.795887]  platform_probe+0x40/0xa0
...
[   28.795979]  ? __pfx_init_module+0x10/0x10 [snd_soc_sst_bytcr_wm5102]

Really fix things this time around by checking dais.num_codecs != 0.

Fixes: 7d99a70b6595 ("ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards")
Cc: [email protected]
Signed-off-by: Hans de Goede <[email protected]>
Reviewed-by: Pierre-Louis Bossart <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>

diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c
index dce6a2086f2a4563b20bcf209a48fd7e1abbec77..6da1517c53c6e77a398b953f00135ea47809423e 100644 (file)
--- a/sound/soc/intel/boards/bxt_rt298.c
+++ b/sound/soc/intel/boards/bxt_rt298.c
@@ -605,7 +605,7 @@ static int broxton_audio_probe(struct platform_device *pdev)
        int i;
 
        for (i = 0; i < ARRAY_SIZE(broxton_rt298_dais); i++) {
-               if (card->dai_link[i].codecs->name &&
+               if (card->dai_link[i].num_codecs &&
                    !strncmp(card->dai_link[i].codecs->name, "i2c-INT343A:00",
                             I2C_NAME_SIZE)) {
                        if (!strncmp(card->name, "broxton-rt298",

diff --git a/sound/soc/intel/boards/bytcht_cx2072x.c b/sound/soc/intel/boards/bytcht_cx2072x.c
index c014d85a08b24755682f3faf97e3e60cd171dc7a..df3c2a7b64d23c0fdb44c095875a45d3ad17ed6c 100644 (file)
--- a/sound/soc/intel/boards/bytcht_cx2072x.c
+++ b/sound/soc/intel/boards/bytcht_cx2072x.c
@@ -241,7 +241,7 @@ static int snd_byt_cht_cx2072x_probe(struct platform_device *pdev)
 
        /* fix index of codec dai */
        for (i = 0; i < ARRAY_SIZE(byt_cht_cx2072x_dais); i++) {
-               if (byt_cht_cx2072x_dais[i].codecs->name &&
+               if (byt_cht_cx2072x_dais[i].num_codecs &&
                    !strcmp(byt_cht_cx2072x_dais[i].codecs->name,
                            "i2c-14F10720:00")) {
                        dai_index = i;

diff --git a/sound/soc/intel/boards/bytcht_da7213.c b/sound/soc/intel/boards/bytcht_da7213.c
index f4ac3ddd148b83757881426a2522adacd3d966d3..08c598b7e1eeeba7eae64264f4baba22a180e511 100644 (file)
--- a/sound/soc/intel/boards/bytcht_da7213.c
+++ b/sound/soc/intel/boards/bytcht_da7213.c
@@ -245,7 +245,7 @@ static int bytcht_da7213_probe(struct platform_device *pdev)
 
        /* fix index of codec dai */
        for (i = 0; i < ARRAY_SIZE(dailink); i++) {
-               if (dailink[i].codecs->name &&
+               if (dailink[i].num_codecs &&
                    !strcmp(dailink[i].codecs->name, "i2c-DLGS7213:00")) {
                        dai_index = i;
                        break;

diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
index 2fcec2e02bb53b403350ee76cb124ed99882087e..77b91ea4dc32ca3cd65e3e6c21fc4a717dbeb1c4 100644 (file)
--- a/sound/soc/intel/boards/bytcht_es8316.c
+++ b/sound/soc/intel/boards/bytcht_es8316.c
@@ -546,7 +546,7 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)
 
        /* fix index of codec dai */
        for (i = 0; i < ARRAY_SIZE(byt_cht_es8316_dais); i++) {
-               if (byt_cht_es8316_dais[i].codecs->name &&
+               if (byt_cht_es8316_dais[i].num_codecs &&
                    !strcmp(byt_cht_es8316_dais[i].codecs->name,
                            "i2c-ESSX8316:00")) {
                        dai_index = i;

diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index a64d1989e28a5ef14a065f95ab0d0c2d4051ca62..db4a33680d9488fa34701555dcc8febfd99cb445 100644 (file)
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -1677,7 +1677,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
 
        /* fix index of codec dai */
        for (i = 0; i < ARRAY_SIZE(byt_rt5640_dais); i++) {
-               if (byt_rt5640_dais[i].codecs->name &&
+               if (byt_rt5640_dais[i].num_codecs &&
                    !strcmp(byt_rt5640_dais[i].codecs->name,
                            "i2c-10EC5640:00")) {
                        dai_index = i;

diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
index 80c841b000a311229c310fec3ba91264696e6025..8514b79f389bb53ab9a9385ce712c1eb02b3d70f 100644 (file)
--- a/sound/soc/intel/boards/bytcr_rt5651.c
+++ b/sound/soc/intel/boards/bytcr_rt5651.c
@@ -910,7 +910,7 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev)
 
        /* fix index of codec dai */
        for (i = 0; i < ARRAY_SIZE(byt_rt5651_dais); i++) {
-               if (byt_rt5651_dais[i].codecs->name &&
+               if (byt_rt5651_dais[i].num_codecs &&
                    !strcmp(byt_rt5651_dais[i].codecs->name,
                            "i2c-10EC5651:00")) {
                        dai_index = i;

diff --git a/sound/soc/intel/boards/bytcr_wm5102.c b/sound/soc/intel/boards/bytcr_wm5102.c
index cccb5e90c0fefc6a888ac302a63ed50a9423342d..e5a7cc606aa90277e38f90679b491c195a59d104 100644 (file)
--- a/sound/soc/intel/boards/bytcr_wm5102.c
+++ b/sound/soc/intel/boards/bytcr_wm5102.c
@@ -605,7 +605,7 @@ static int snd_byt_wm5102_mc_probe(struct platform_device *pdev)
 
        /* find index of codec dai */
        for (i = 0; i < ARRAY_SIZE(byt_wm5102_dais); i++) {
-               if (byt_wm5102_dais[i].codecs->name &&
+               if (byt_wm5102_dais[i].num_codecs &&
                    !strcmp(byt_wm5102_dais[i].codecs->name,
                            "wm5102-codec")) {
                        dai_index = i;

diff --git a/sound/soc/intel/boards/cht_bsw_rt5645.c b/sound/soc/intel/boards/cht_bsw_rt5645.c
index eb41b7115d01dd38685d5a10cd393e46eb4106a4..1da9ceee4d593ea43a08ac62086c9b22deb2165b 100644 (file)
--- a/sound/soc/intel/boards/cht_bsw_rt5645.c
+++ b/sound/soc/intel/boards/cht_bsw_rt5645.c
@@ -569,7 +569,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
 
        /* set correct codec name */
        for (i = 0; i < ARRAY_SIZE(cht_dailink); i++)
-               if (cht_dailink[i].codecs->name &&
+               if (cht_dailink[i].num_codecs &&
                    !strcmp(cht_dailink[i].codecs->name,
                            "i2c-10EC5645:00")) {
                        dai_index = i;

diff --git a/sound/soc/intel/boards/cht_bsw_rt5672.c b/sound/soc/intel/boards/cht_bsw_rt5672.c
index be2d1a8dbca807dd1f4af070382d2d2f169c9e27..d68e5bc755dee52439954db6b0e46af91af2cf9a 100644 (file)
--- a/sound/soc/intel/boards/cht_bsw_rt5672.c
+++ b/sound/soc/intel/boards/cht_bsw_rt5672.c
@@ -466,7 +466,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
 
        /* find index of codec dai */
        for (i = 0; i < ARRAY_SIZE(cht_dailink); i++) {
-               if (cht_dailink[i].codecs->name &&
+               if (cht_dailink[i].num_codecs &&
                    !strcmp(cht_dailink[i].codecs->name, RT5672_I2C_DEFAULT)) {
                        dai_index = i;
                        break;