All of lore.kernel.org
 help / color / mirror / Atom feed
From: Cezary Rojewski <cezary.rojewski@intel.com>
To: alsa-devel@alsa-project.org, tiwai@suse.com
Cc: Cezary Rojewski <cezary.rojewski@intel.com>,
	pierre-louis.bossart@linux.intel.com, hdegoede@redhat.com,
	broonie@kernel.org, amadeuszx.slawinski@linux.intel.com
Subject: [PATCH 2/9] ALSA: hda: Fix null-ptr-deref when i915 fails and hdmi is denylisted
Date: Wed,  6 Jul 2022 14:02:23 +0200	[thread overview]
Message-ID: <20220706120230.427296-3-cezary.rojewski@intel.com> (raw)
In-Reply-To: <20220706120230.427296-1-cezary.rojewski@intel.com>

If snd_hda_hdmi_codec module is denylisted and any event causes i915
enumeration to fail, is_likely_hdmi_codec() ends in null-ptr-deref.

As snd_soc_hda is an ASoC-based driver, its initialization is delayed
until all the necessary components appear in the system - allowing
actual sound card to enumerate. snd_hda_codec_configure() gets called by
the avs-driver core during probe_codecs() but the
snd_hda_codec_device_new(), necessary to complete codecs initialization,
happens only when codec-component of hda sound card is being probed.

Denylisting snd_hda_codec_hdmi module causes snd_hda_codec_configure()
to reach: codec_bind_generic() -> is_likely_hdmi_codec() which makes use
of ->wcaps and at this point the it isn't initialized yet - again,
requires completion of snd_hda_codec_device_new().

Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
---
 sound/pci/hda/hda_bind.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
index c572fb5886d5..cae9a975cbcc 100644
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -248,6 +248,13 @@ static bool is_likely_hdmi_codec(struct hda_codec *codec)
 {
 	hda_nid_t nid;
 
+	/*
+	 * For ASoC users, if snd_hda_hdmi_codec module is denylisted and any
+	 * event causes i915 enumeration to fail, ->wcaps remains uninitialized.
+	 */
+	if (!codec->wcaps)
+		return true;
+
 	for_each_hda_codec_node(nid, codec) {
 		unsigned int wcaps = get_wcaps(codec, nid);
 		switch (get_wcaps_type(wcaps)) {
-- 
2.25.1


  parent reply	other threads:[~2022-07-06 11:54 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-07-06 12:02 [PATCH 0/9] ALSA: hda: Codec-reload bug fixes and cleanups Cezary Rojewski
2022-07-06 12:02 ` [PATCH 1/9] ALSA: hda: Do not unset preset when cleaning up codec Cezary Rojewski
2022-07-09 16:34   ` Takashi Iwai
2022-07-11  8:25     ` Cezary Rojewski
2022-07-11 14:12       ` Takashi Iwai
2022-07-12  9:42         ` Cezary Rojewski
2022-07-12 10:46           ` Takashi Iwai
2022-07-12 10:58             ` Cezary Rojewski
2022-07-15 14:55               ` Takashi Iwai
2023-01-17 14:45                 ` Cezary Rojewski
2023-01-17 14:51                   ` Takashi Iwai
2022-07-06 12:02 ` Cezary Rojewski [this message]
2022-07-06 12:02 ` [PATCH 3/9] ALSA: hda: Make device usage_count consistent across subsequent probing Cezary Rojewski
2022-07-06 12:02 ` [PATCH 4/9] ALSA: hda: Fix put_device() inconsistency in error path Cezary Rojewski
2022-07-06 12:02 ` [PATCH 5/9] ALSA: hda: Skip event processing for unregistered codecs Cezary Rojewski
2022-07-09 16:47   ` Takashi Iwai
2022-07-15 14:27     ` Takashi Iwai
2022-07-06 12:02 ` [PATCH 6/9] ALSA: hda: Fix page fault in snd_hda_codec_shutdown() Cezary Rojewski
2022-07-15 18:16   ` Pierre-Louis Bossart
2022-07-15 18:23     ` Takashi Iwai
2022-07-17 10:05       ` Cezary Rojewski
2022-07-06 12:02 ` [PATCH 7/9] ALSA: hda: Reset all SIE bits in INTCTL Cezary Rojewski
2022-07-06 12:02 ` [PATCH 8/9] ALSA: hda: Remove unused macro definition Cezary Rojewski
2022-07-06 12:02 ` [PATCH 9/9] ALSA: hda/realtek: Remove redundant init_hook() in alc_default_init() Cezary Rojewski
2022-07-09 16:46   ` Takashi Iwai
2022-07-11  8:12     ` Cezary Rojewski
2022-07-09 16:50 ` [PATCH 0/9] ALSA: hda: Codec-reload bug fixes and cleanups Takashi Iwai

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220706120230.427296-3-cezary.rojewski@intel.com \
    --to=cezary.rojewski@intel.com \
    --cc=alsa-devel@alsa-project.org \
    --cc=amadeuszx.slawinski@linux.intel.com \
    --cc=broonie@kernel.org \
    --cc=hdegoede@redhat.com \
    --cc=pierre-louis.bossart@linux.intel.com \
    --cc=tiwai@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.