linux-kernel - Re: [BUG BISECT] NULL pointer after commit "ASoC: dapm: Only power up active channels from a DAI"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 6 Feb 2019 09:58:22 +0000
From:   Charles Keepax <ckeepax@...nsource.cirrus.com>
To:     Krzysztof Kozlowski <krzk@...nel.org>
CC:     Liam Girdwood <lgirdwood@...il.com>,
        Mark Brown <broonie@...nel.org>,
        Jaroslav Kysela <perex@...ex.cz>,
        Takashi Iwai <tiwai@...e.com>, <alsa-devel@...a-project.org>,
        <linux-kernel@...r.kernel.org>,
        <linux-samsung-soc@...r.kernel.org>,
        Sylwester Nawrocki <s.nawrocki@...sung.com>,
        Marek Szyprowski <m.szyprowski@...sung.com>
Subject: Re: [BUG BISECT] NULL pointer after commit "ASoC: dapm: Only power
 up active channels from a DAI"

On Tue, Feb 05, 2019 at 10:16:22PM +0100, Krzysztof Kozlowski wrote:
> Bisect pointed to commit:
>     commit 078a85f2806f0ffd11289009462a6a390f9adb5c
>     Author: Charles Keepax <ckeepax@...nsource.cirrus.com>
>     Date:   Thu Jan 31 13:30:18 2019 +0000
>         ASoC: dapm: Only power up active channels from a DAI
> 
> as a bad commit for NULL pointer on my Odroid XU3 and Odroid U3 board when
> doing "aplay /usr/share/sounds/alsa/Front_Right.wav".
> 
> 1. Arch ARM Linux
> 2. exynos_defconfig
> 3. Odroid U3, XU3, Exynos SoC, ARMv7
> 
> Last address is in calltrace:
> c079552c
> dapm_update_dai_unlocked
> sound/soc/soc-dapm.c:2586
> 

Apologies for this one, is a little strange. I am assuming either
we end up with a NULL widget or more likely given the line
number a NULL path/widget on the path. Having some difficulty seeing
how we get into that state though.

Could you confirm what machine driver/DT is being used here? I am
assuming this is arch/arm/boot/dts/exynos4412-odroidu3.dts and
sound/soc/samsung/odroid.c. So will investigate those see if I
can find anything.

And could you try this diff and send through the output:

diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 482ddb825fb59..9ee44b0192874 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2570,16 +2570,37 @@ static int dapm_update_dai_unlocked(struct snd_pcm_substream *substream,
        else
                w = dai->capture_widget;

+ if (!w) {
+         pr_err("CK -- NULL widget on %s\n", dai->name);
+         return 0;
+ }
+
        dev_dbg(dai->dev, "Update DAI routes for %s %s\n", dai->name,
                dir == SNDRV_PCM_STREAM_PLAYBACK ? "playback" : "capture");

        snd_soc_dapm_widget_for_each_sink_path(w, p) {
+         if (!p) {
+                 pr_err("DEBUG -- NULL sink path on %s\n", w->name);
+                 continue;
+         }
+         if (!p->sink) {
+                 pr_err("DEBUG -- NULL wink widget on %s\n", w->name);
+                 continue;
+         }
                ret = dapm_update_dai_chan(p, p->sink, channels);
                if (ret < 0)
                        return ret;
        }

        snd_soc_dapm_widget_for_each_source_path(w, p) {
+         if (!p) {
+                 pr_err("DEBUG -- NULL source path on %s\n", w->name);
+                 continue;
+         }
+         if (!p->source) {
+                 pr_err("DEBUG -- NULL source widget on %s\n", w->name);
+                 continue;
+         }
                ret = dapm_update_dai_chan(p, p->source, channels);
                if (ret < 0)
                        return ret;

Thanks,
Charles