linux-kernel - Re: [BUG BISECT] NULL pointer after commit "ASoC: dapm: Only power up active channels from a DAI"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 06 Feb 2019 11:11:03 +0100
From:   Sylwester Nawrocki <s.nawrocki@...sung.com>
To:     Krzysztof Kozlowski <krzk@...nel.org>,
        linux-kernel@...r.kernel.org, ckeepax@...nsource.cirrus.com
Cc:     Liam Girdwood <lgirdwood@...il.com>,
        Mark Brown <broonie@...nel.org>,
        Jaroslav Kysela <perex@...ex.cz>,
        Takashi Iwai <tiwai@...e.com>, alsa-devel@...a-project.org,
        linux-samsung-soc@...r.kernel.org,
        Marek Szyprowski <m.szyprowski@...sung.com>
Subject: Re: [BUG BISECT] NULL pointer after commit
 "ASoC: dapm: Only power up active channels from a DAI"

On 2/6/19 10:46, Sylwester Nawrocki wrote:
> On 2/5/19 22:16, Krzysztof Kozlowski wrote:
>> Bisect pointed to commit:
>>     commit 078a85f2806f0ffd11289009462a6a390f9adb5c
>>     Author: Charles Keepax <ckeepax@...nsource.cirrus.com>
>>     Date:   Thu Jan 31 13:30:18 2019 +0000
>>         ASoC: dapm: Only power up active channels from a DAI
>>
>> as a bad commit for NULL pointer on my Odroid XU3 and Odroid U3 board when
>> doing "aplay /usr/share/sounds/alsa/Front_Right.wav".
>>
>> 1. Arch ARM Linux
>> 2. exynos_defconfig
>> 3. Odroid U3, XU3, Exynos SoC, ARMv7
>>
>> Last address is in calltrace:
>> c079552c
>> dapm_update_dai_unlocked
>> sound/soc/soc-dapm.c:2586
> 
> Thanks for bisecting this, I ran into same issue last night and I'm starting
> to debug this now. I have added some debug prints and it looks like it oopses
> on NULL playback_widget of the dummy DAI.
> 
> [   30.701182] hdmi-audio-codec hdmi-audio-codec.0.auto: Update DAI routes for i2s-hifi playback
> [   30.709630] dapm_update_dai_unlocked:2586 w=8bd27d28
> [   30.714403] dapm_update_dai_unlocked:2594 w=8bd27d28
> [   30.724688] max98090 5-0010: Update DAI routes for HiFi playback
> [   30.730163] dapm_update_dai_unlocked:2586 w=3fc942af
> [   30.735154] dapm_update_dai_unlocked:2594 w=3fc942af
> [   30.745051] snd-soc-dummy snd-soc-dummy: Update DAI routes for snd-soc-dummy-dai playback
> [   30.753128] dapm_update_dai_unlocked:2586 w=  (null)
> [   30.758114] Unable to handle kernel NULL pointer dereference at virtual address 0000007c

With a change as below there is no oops and everything works again,
but I'm not sure this is a proper fix.

diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 5b74dffc9c11..111a23a9708a 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2580,6 +2580,9 @@ static int dapm_update_dai_unlocked(struct snd_pcm_substream *substream,
        else
                w = dai->capture_widget;
 
+       if (!w)
+               return 0;
+
        dev_dbg(dai->dev, "Update DAI routes for %s %s\n", dai->name,
                dir == SNDRV_PCM_STREAM_PLAYBACK ? "playback" : "capture");

-- 
Thanks,
Sylwester