linux-kernel - [PATCH] ASoC: mediatek: mt8192: Check existence of dai

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon,  8 Jan 2024 17:44:58 -0300
From: Nícolas F. R. A. Prado <nfraprado@...labora.com>
To: Mark Brown <broonie@...nel.org>
Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>,
	kernel@...labora.com,
	Nícolas F. R. A. Prado <nfraprado@...labora.com>,
	Jaroslav Kysela <perex@...ex.cz>,
	Kuninori Morimoto <kuninori.morimoto.gx@...esas.com>,
	Liam Girdwood <lgirdwood@...il.com>,
	Matthias Brugger <matthias.bgg@...il.com>,
	Nícolas F. R. A. Prado via Alsa-devel <alsa-devel@...a-project.org>,
	Rob Herring <robh@...nel.org>,
	Takashi Iwai <tiwai@...e.com>,
	linux-arm-kernel@...ts.infradead.org,
	linux-kernel@...r.kernel.org,
	linux-mediatek@...ts.infradead.org,
	linux-sound@...r.kernel.org
Subject: [PATCH] ASoC: mediatek: mt8192: Check existence of dai_name before dereferencing

Following commit 13f58267cda3 ("ASoC: soc.h: don't create dummy
Component via COMP_DUMMY()"), the dai_name field is only populated for
dummy components after the card is registered. This causes a null
pointer dereference in the mt8192-mt6359 sound card driver's probe
function when searching for a dai_name among all the card's dai links.

Verify that the dai_name is non-null before passing it to strcmp. While
at it, also check that there's at least one codec.

Reported-by: "kernelci.org bot" <bot@...nelci.org>
Closes: https://linux.kernelci.org/test/case/id/6582cd6d992645c680e13478/
Fixes: 13f58267cda3 ("ASoC: soc.h: don't create dummy Component via COMP_DUMMY()")
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@...labora.com>

---

 sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
index 5bd6addd1450..bfcb2c486c39 100644
--- a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+++ b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
@@ -1208,7 +1208,8 @@ static int mt8192_mt6359_dev_probe(struct platform_device *pdev)
 			dai_link->ignore = 0;
 		}

-		if (strcmp(dai_link->codecs[0].dai_name, RT1015_CODEC_DAI) == 0)
+		if (dai_link->num_codecs && dai_link->codecs[0].dai_name &&
+		    strcmp(dai_link->codecs[0].dai_name, RT1015_CODEC_DAI) == 0)
 			dai_link->ops = &mt8192_rt1015_i2s_ops;

 		if (!dai_link->platforms->name)
-- 
2.43.0