linux-kernel - Re: [alsa-devel] [PATCH] ASoC: cht_bsw_max98090_ti: Fix NULL pointer dereference while accessing jack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20171012195121.GA17862@roeck-us.net>
Date:   Thu, 12 Oct 2017 12:51:21 -0700
From:   Guenter Roeck <linux@...ck-us.net>
To:     Pierre-Louis Bossart <pierre-louis.bossart@...ux.intel.com>
Cc:     Liam Girdwood <lgirdwood@...il.com>, alsa-devel@...a-project.org,
        Mengdong Lin <mengdong.lin@...ux.intel.com>,
        linux-kernel@...r.kernel.org, Takashi Iwai <tiwai@...e.com>,
        Mark Brown <broonie@...nel.org>,
        Guenter Roeck <groeck@...omium.org>
Subject: Re: [alsa-devel] [PATCH] ASoC: cht_bsw_max98090_ti: Fix NULL pointer
 dereference while accessing jack

On Thu, Oct 12, 2017 at 02:40:58PM -0500, Pierre-Louis Bossart wrote:
> On 10/12/17 2:28 PM, Guenter Roeck wrote:
> >From: Guenter Roeck <groeck@...omium.org>
> >
> >Commit f2ed6b07645e ("ASoC: Make aux_dev more like a generic component")
> >caused a regression on this driver, since now a kernel oops is seen
> >when the driver is loaded, or more specifically when
> >ts3a227e_enable_jack_detect() is called.
> >
> >That commit changed the probing of aux_devs before checking new DAI links,
> >so cht_max98090_headset_init is now called before cht_codec_init. The
> >kernel crashes due a NULL pointer dereference in cht_max98090_headset_init
> >since there is a call that tries to access the jack pointer which has not
> >been allocated yet.
> >
> >This patch moves the new jack object creation from cht_codec_init to
> >cht_max98090_headset_init, making sure the jack is created before is
> >accessed.
> >
> >Also see upstream commit 5f22449344d9 ("ASoC: rockchip-max98090: Fix NULL
> >pointer dereference while accessing to jack.") for a similar fix in the
> >rockchip-max98090 driver.
> 
> Are you sure this isn't fixed already? Some of the changes suggested have
> already been applied by Mark Brown on his for-next branch.
> 
Ah yes, you are right. I should have checked -next. Sorry for the noise.

Guenter

>
> >Fixes: f2ed6b07645e ("ASoC: Make aux_dev more like a generic component")
> >Cc: Mengdong Lin <mengdong.lin@...ux.intel.com>
> >Signed-off-by: Guenter Roeck <groeck@...omium.org>
> >---
> >  sound/soc/intel/boards/cht_bsw_max98090_ti.c | 55 ++++++++++++++--------------
> >  1 file changed, 27 insertions(+), 28 deletions(-)
> >
> >diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
> >index 20755ecc7f9e..c1518db7bb61 100644
> >--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
> >+++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
> >@@ -111,37 +111,12 @@ static struct notifier_block cht_jack_nb = {
> >  static int cht_codec_init(struct snd_soc_pcm_runtime *runtime)
> >  {
> >-	int ret;
> >-	int jack_type;
> >  	struct cht_mc_private *ctx = snd_soc_card_get_drvdata(runtime->card);
> >-	struct snd_soc_jack *jack = &ctx->jack;
> >-
> >-	/**
> >-	* TI supports 4 butons headset detection
> >-	* KEY_MEDIA
> >-	* KEY_VOICECOMMAND
> >-	* KEY_VOLUMEUP
> >-	* KEY_VOLUMEDOWN
> >-	*/
> >-	if (ctx->ts3a227e_present)
> >-		jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE |
> >-					SND_JACK_BTN_0 | SND_JACK_BTN_1 |
> >-					SND_JACK_BTN_2 | SND_JACK_BTN_3;
> >-	else
> >-		jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE;
> >-
> >-	ret = snd_soc_card_jack_new(runtime->card, "Headset Jack",
> >-					jack_type, jack, NULL, 0);
> >-
> >-	if (ret) {
> >-		dev_err(runtime->dev, "Headset Jack creation failed %d\n", ret);
> >-		return ret;
> >-	}
> >  	if (ctx->ts3a227e_present)
> >-		snd_soc_jack_notifier_register(jack, &cht_jack_nb);
> >+		snd_soc_jack_notifier_register(&ctx->jack, &cht_jack_nb);
> >-	return ret;
> >+	return 0;
> >  }
> >  static int cht_codec_fixup(struct snd_soc_pcm_runtime *rtd,
> >@@ -188,8 +163,32 @@ static int cht_max98090_headset_init(struct snd_soc_component *component)
> >  {
> >  	struct snd_soc_card *card = component->card;
> >  	struct cht_mc_private *ctx = snd_soc_card_get_drvdata(card);
> >+	struct snd_soc_jack *jack = &ctx->jack;
> >+	int jack_type;
> >+	int ret;
> >+
> >+	/*
> >+	 * TI supports 4 butons headset detection
> >+	 * KEY_MEDIA
> >+	 * KEY_VOICECOMMAND
> >+	 * KEY_VOLUMEUP
> >+	 * KEY_VOLUMEDOWN
> >+	 */
> >+	if (ctx->ts3a227e_present)
> >+		jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE |
> >+					SND_JACK_BTN_0 | SND_JACK_BTN_1 |
> >+					SND_JACK_BTN_2 | SND_JACK_BTN_3;
> >+	else
> >+		jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE;
> >+
> >+	ret = snd_soc_card_jack_new(card, "Headset Jack", jack_type, jack,
> >+				    NULL, 0);
> >+	if (ret) {
> >+		dev_err(card->dev, "Headset Jack creation failed %d\n", ret);
> >+		return ret;
> >+	}
> >-	return ts3a227e_enable_jack_detect(component, &ctx->jack);
> >+	return ts3a227e_enable_jack_detect(component, jack);
> >  }
> >  static const struct snd_soc_ops cht_aif1_ops = {
> >
>