linux-kernel - Re: [PATCH] ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0946e25c-ed51-43c2-ba28-ff9c18178bc6@opensource.cirrus.com>
Date: Thu, 4 Dec 2025 11:00:38 +0000
From: Richard Fitzgerald <rf@...nsource.cirrus.com>
To: Denis Arefev <arefev@...mel.ru>, David Rhodes <david.rhodes@...rus.com>
Cc: Jaroslav Kysela <perex@...ex.cz>, Takashi Iwai <tiwai@...e.com>,
        Stefan Binding <sbinding@...nsource.cirrus.com>,
        linux-sound@...r.kernel.org, patches@...nsource.cirrus.com,
        linux-kernel@...r.kernel.org, lvc-project@...uxtesting.org,
        stable@...r.kernel.org
Subject: Re: [PATCH] ALSA: hda: cs35l41: Fix NULL pointer dereference in
 cs35l41_hda_read_acpi()

On 02/12/2025 10:13 am, Denis Arefev wrote:
> The acpi_get_first_physical_node() function can return NULL, in which
> case the get_device() function also returns NULL, but this value is
> then dereferenced without checking,so add a check to prevent a crash.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 7b2f3eb492da ("ALSA: hda: cs35l41: Add support for CS35L41 in HDA systems")
> Cc: stable@...r.kernel.org
> Signed-off-by: Denis Arefev <arefev@...mel.ru>
> ---
>   sound/hda/codecs/side-codecs/cs35l41_hda.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/sound/hda/codecs/side-codecs/cs35l41_hda.c b/sound/hda/codecs/side-codecs/cs35l41_hda.c
> index c0f2a3ff77a1..21e00055c0c4 100644
> --- a/sound/hda/codecs/side-codecs/cs35l41_hda.c
> +++ b/sound/hda/codecs/side-codecs/cs35l41_hda.c
> @@ -1901,6 +1901,8 @@ static int cs35l41_hda_read_acpi(struct cs35l41_hda *cs35l41, const char *hid, i
>   
>   	cs35l41->dacpi = adev;
>   	physdev = get_device(acpi_get_first_physical_node(adev));
> +	if (!physdev)
> +		return -ENODEV;
>   
>   	sub = acpi_get_subsystem_id(ACPI_HANDLE(physdev));
>   	if (IS_ERR(sub))
Reviewed-by: Richard Fitzgerald <rf@...nsource.cirrus.com>