| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20211015133619.4698-10-rf@opensource.cirrus.com>
Date: Fri, 15 Oct 2021 14:36:12 +0100
From: Richard Fitzgerald <rf@...nsource.cirrus.com>
To: <broonie@...nel.org>
CC: <alsa-devel@...a-project.org>, <linux-kernel@...r.kernel.org>,
<patches@...nsource.cirrus.com>,
Richard Fitzgerald <rf@...nsource.cirrus.com>
Subject: [PATCH 09/16] ASoC: cs42l42: Prevent NULL pointer deref in interrupt handler
The interrupt handling code was getting the struct device* from a
struct snd_soc_component* stored in struct cs42l42_private. If the
interrupt was asserted before ASoC calls component_probe() the
snd_soc_component* will be NULL.
The stored snd_soc_component* is not actually used for anything other
than indirectly getting the struct device*. Remove it, and store the
struct device* in struct cs42l42_private.
Signed-off-by: Richard Fitzgerald <rf@...nsource.cirrus.com>
---
sound/soc/codecs/cs42l42.c | 28 +++++++++-------------------
sound/soc/codecs/cs42l42.h | 2 +-
2 files changed, 10 insertions(+), 20 deletions(-)
diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
index cf1f68474d21..174f738e9e5a 100644
--- a/sound/soc/codecs/cs42l42.c
+++ b/sound/soc/codecs/cs42l42.c
@@ -506,17 +506,7 @@ static int cs42l42_set_jack(struct snd_soc_component *component, struct snd_soc_
return 0;
}
-static int cs42l42_component_probe(struct snd_soc_component *component)
-{
- struct cs42l42_private *cs42l42 = snd_soc_component_get_drvdata(component);
-
- cs42l42->component = component;
-
- return 0;
-}
-
static const struct snd_soc_component_driver soc_component_dev_cs42l42 = {
- .probe = cs42l42_component_probe,
.set_jack = cs42l42_set_jack,
.dapm_widgets = cs42l42_dapm_widgets,
.num_dapm_widgets = ARRAY_SIZE(cs42l42_dapm_widgets),
@@ -1168,7 +1158,7 @@ static void cs42l42_process_hs_type_detect(struct cs42l42_private *cs42l42)
*/
if (cs42l42->hs_type == CS42L42_PLUG_INVALID ||
cs42l42->hs_type == CS42L42_PLUG_HEADPHONE) {
- dev_dbg(cs42l42->component->dev, "Running Manual Detection Fallback\n");
+ dev_dbg(cs42l42->dev, "Running Manual Detection Fallback\n");
cs42l42_manual_hs_type_detect(cs42l42);
}
@@ -1467,19 +1457,19 @@ static int cs42l42_handle_button_press(struct cs42l42_private *cs42l42)
switch (bias_level) {
case 1: /* Function C button press */
bias_level = SND_JACK_BTN_2;
- dev_dbg(cs42l42->component->dev, "Function C button press\n");
+ dev_dbg(cs42l42->dev, "Function C button press\n");
break;
case 2: /* Function B button press */
bias_level = SND_JACK_BTN_1;
- dev_dbg(cs42l42->component->dev, "Function B button press\n");
+ dev_dbg(cs42l42->dev, "Function B button press\n");
break;
case 3: /* Function D button press */
bias_level = SND_JACK_BTN_3;
- dev_dbg(cs42l42->component->dev, "Function D button press\n");
+ dev_dbg(cs42l42->dev, "Function D button press\n");
break;
case 4: /* Function A button press */
bias_level = SND_JACK_BTN_0;
- dev_dbg(cs42l42->component->dev, "Function A button press\n");
+ dev_dbg(cs42l42->dev, "Function A button press\n");
break;
default:
bias_level = 0;
@@ -1553,7 +1543,6 @@ static const struct cs42l42_irq_params irq_params_table[] = {
static irqreturn_t cs42l42_irq_thread(int irq, void *data)
{
struct cs42l42_private *cs42l42 = (struct cs42l42_private *)data;
- struct snd_soc_component *component = cs42l42->component;
unsigned int stickies[12];
unsigned int masks[12];
unsigned int current_plug_status;
@@ -1600,7 +1589,7 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data)
default:
break;
}
- dev_dbg(component->dev, "Auto detect done (%d)\n", cs42l42->hs_type);
+ dev_dbg(cs42l42->dev, "Auto detect done (%d)\n", cs42l42->hs_type);
}
}
@@ -1634,7 +1623,7 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data)
SND_JACK_BTN_0 | SND_JACK_BTN_1 |
SND_JACK_BTN_2 | SND_JACK_BTN_3);
- dev_dbg(component->dev, "Unplug event\n");
+ dev_dbg(cs42l42->dev, "Unplug event\n");
}
break;
@@ -1650,7 +1639,7 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data)
CS42L42_M_HSBIAS_HIZ_MASK)) {
if (current_button_status & CS42L42_M_DETECT_TF_MASK) {
- dev_dbg(component->dev, "Button released\n");
+ dev_dbg(cs42l42->dev, "Button released\n");
report = 0;
} else if (current_button_status & CS42L42_M_DETECT_FT_MASK) {
report = cs42l42_handle_button_press(cs42l42);
@@ -2004,6 +1993,7 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,
if (!cs42l42)
return -ENOMEM;
+ cs42l42->dev = &i2c_client->dev;
i2c_set_clientdata(i2c_client, cs42l42);
cs42l42->regmap = devm_regmap_init_i2c(i2c_client, &cs42l42_regmap);
diff --git a/sound/soc/codecs/cs42l42.h b/sound/soc/codecs/cs42l42.h
index 2343213d0cdb..d30643398084 100644
--- a/sound/soc/codecs/cs42l42.h
+++ b/sound/soc/codecs/cs42l42.h
@@ -831,7 +831,7 @@ static const char *const cs42l42_supply_names[CS42L42_NUM_SUPPLIES] = {
struct cs42l42_private {
struct regmap *regmap;
- struct snd_soc_component *component;
+ struct device *dev;
struct regulator_bulk_data supplies[CS42L42_NUM_SUPPLIES];
struct gpio_desc *reset_gpio;
struct completion pdn_done;
--
2.11.0
Powered by blists - more mailing lists