From patchwork Fri Dec 8 17:38:19 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gergo Koteles X-Patchwork-Id: 175980 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp5615323vqy; Fri, 8 Dec 2023 09:46:10 -0800 (PST) X-Google-Smtp-Source: AGHT+IGc4tVjim+90B3Kpmxsx3c70feAx+b4ThpdvAcddVP2B2xES0grFTcZKbNl5FWCGeSlp5eX X-Received: by 2002:a17:90a:ac17:b0:286:ca1d:e3ba with SMTP id o23-20020a17090aac1700b00286ca1de3bamr472819pjq.11.1702057569786; Fri, 08 Dec 2023 09:46:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702057569; cv=none; d=google.com; s=arc-20160816; b=me6qNPiK1j6ZkrPoVW3AgV32bjW5XSIpnYS8BlX17r7OInNrPOOrwD7jinMIgPrI32 jwTT9ux2OQkUOp5l2uSUbO/Lkzs/63+kBcoPMfKecpH8X85oUCzcyeuYvu2tHzxgRua9 gJmfVhhkF29tnHzJ3tStP2PRUGsm5k024/xxzI5nwsgbJJL2PnZvphUbiXfgCWOZ5YSX 6z15/SFsIw/g9e8m7euUwSE5jKoKzqayhDRSM9+7YzZRBLUOz1H044SOd6/8uXg5+W3Q 6Y4g9EPz137+EI+EfYas8Y/6tRJJ+aOxU1H8/T1M+icZ53RXzz5Q4zcJ0OcIc9ouLrdQ +lDQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=6XpqwX7YgqSwjaIrsQt+Rt/fN6sBiKAusQSNBL4kfUM=; fh=AtUyipZqf9Wt3VmKECtwTscIVbxtj0bqEzvKFfEmcRc=; b=anqCZP6Wrc5wNcKrmqMu47ZNW0K69lacY7QtGxnIBsOnbDAHIBJpZG4HAt510R1f9T hvhPqVJUk5Ea8WdKEpUrbwrzMFPxbQPCgjLiqvo8ijYYsZsesNpu7Df673qpX0dnii12 9QJU7f1Xziv1plAZBwi3DVpBSxHobYQx2BRvXZlFJkV5HHNkQAXYzbezTnV+hkLp78BG OcGM8kiJs9UOnXrKEDgNSNFGcUNgi5NPzA5L7JhZJQO7JNIlhdTt0/+aM1Q2l2lS5Y8R ye8TOJJRlxO6y//iEudtiYbiKGEy1rPpZUFcrlcBmmA6WWBuGuqVozwJlTzV6DkmCjkw XzLg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:6 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=irl.hu Received: from pete.vger.email (pete.vger.email. [2620:137:e000::3:6]) by mx.google.com with ESMTPS id z7-20020a17090abd8700b00285cc4f0e09si1987286pjr.185.2023.12.08.09.46.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Dec 2023 09:46:09 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:6 as permitted sender) client-ip=2620:137:e000::3:6; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:6 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=irl.hu Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by pete.vger.email (Postfix) with ESMTP id 69BB58081CFA; Fri, 8 Dec 2023 09:45:19 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at pete.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233768AbjLHRpK (ORCPT + 99 others); Fri, 8 Dec 2023 12:45:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51276 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229811AbjLHRpI (ORCPT ); Fri, 8 Dec 2023 12:45:08 -0500 X-Greylist: delayed 305 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Fri, 08 Dec 2023 09:45:14 PST Received: from irl.hu (irl.hu [95.85.9.111]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0B23CF4; Fri, 8 Dec 2023 09:45:13 -0800 (PST) Received: from fedori.lan (51b690cd.dsl.pool.telekom.hu [::ffff:81.182.144.205]) (AUTH: CRAM-MD5 soyer@irl.hu, ) by irl.hu with ESMTPSA id 00000000000719DB.00000000657354F6.0011CADC; Fri, 08 Dec 2023 18:40:06 +0100 From: Gergo Koteles To: Shenghao Ding , Kevin Lu , Baojun Xu , Jaroslav Kysela , Takashi Iwai Cc: linux-kernel@vger.kernel.org, alsa-devel@alsa-project.org, Gergo Koteles , stable@vger.kernel.org Subject: [PATCH] ALSA: hda/tas2781: leave hda_component in usable state Date: Fri, 8 Dec 2023 18:38:19 +0100 Message-ID: <052224ccd9d24dac777c468d2ef94d5fabe619a0.1702056528.git.soyer@irl.hu> X-Mailer: git-send-email 2.43.0 Mime-Version: 1.0 X-Mime-Autoconverted: from 8bit to 7bit by courier 1.0 X-Spam-Status: No, score=-0.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on pete.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (pete.vger.email [0.0.0.0]); Fri, 08 Dec 2023 09:45:19 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1784736718171524731 X-GMAIL-MSGID: 1784736718171524731 Unloading then loading the module causes a NULL ponter dereference. The hda_unbind zeroes the hda_component, later the hda_bind tries to dereference the codec field. The hda_component is only initialized once by tas2781_generic_fixup. Set only previously modified fields to NULL. BUG: kernel NULL pointer dereference, address: 0000000000000322 Call Trace: ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? tas2781_hda_bind+0x59/0x140 [snd_hda_scodec_tas2781_i2c] component_bind_all+0xf3/0x240 try_to_bring_up_aggregate_device+0x1c3/0x270 __component_add+0xbc/0x1a0 tas2781_hda_i2c_probe+0x289/0x3a0 [snd_hda_scodec_tas2781_i2c] i2c_device_probe+0x136/0x2e0 Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") CC: stable@vger.kernel.org Signed-off-by: Gergo Koteles --- sound/pci/hda/tas2781_hda_i2c.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) base-commit: ffc253263a1375a65fa6c9f62a893e9767fbebfa diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c index fb802802939e..ba4fdae8ec9b 100644 --- a/sound/pci/hda/tas2781_hda_i2c.c +++ b/sound/pci/hda/tas2781_hda_i2c.c @@ -612,9 +612,13 @@ static void tas2781_hda_unbind(struct device *dev, { struct tasdevice_priv *tas_priv = dev_get_drvdata(dev); struct hda_component *comps = master_data; + comps = &comps[tas_priv->index]; - if (comps[tas_priv->index].dev == dev) - memset(&comps[tas_priv->index], 0, sizeof(*comps)); + if (comps[tas_priv->index].dev == dev) { + comps->dev = NULL; + strscpy(comps->name, "", sizeof(comps->name)); + comps->playback_hook = NULL; + } tasdevice_config_info_remove(tas_priv); tasdevice_dsp_remove(tas_priv);