diff options
| author | Mario Limonciello <mario.limonciello@amd.com> | 2025-03-19 09:56:31 -0500 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2025-03-20 18:56:49 +0000 |
| commit | 6271b746e40ebaf24dc54be5f4248f5a61618871 (patch) | |
| tree | f0c2e7f089d7f1e43258ab6e059d24a77c380050 /sound | |
| parent | 3160e750530e8888fce014def32b60731beee5b2 (diff) | |
ASoC: dmic: Fix NULL pointer dereference
Regulator support was introduced in commit d3321a20b5111 ("ASoC: dmic: add
regulator support"). During probe `dmic->vref` is initialized with
devm_regulator_get_optional() but in the error flow doesn't get cleared in
the case that PTR_ERR(dmic->vref) is -ENODEV. This leads to the following
NULL pointer deref.
```
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 7 UID: 1000 PID: 1587 Comm: wireplumber Not tainted 6.14.0-rc7-next-20250318 #1 PREEMPT(voluntary)
RIP: 0010:regulator_enable+0x17/0x70
RSP: 0018:ffffcc10c1fe7a38 EFLAGS: 00010282
RAX: ffff8bccc1c25010 RBX: ffffffffffffffed RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffcc10c1fe7a38 RDI: ffffffffffffffed
RBP: ffffcc10c1fe7a68 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8bcccd51f800
R13: ffffffffc1086e88 R14: 0000000000000001 R15: 0000000000000001
FS: 00007f927bc35800(0000) GS:ffff8bd44f09f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000065 CR3: 00000001332c6000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
? show_regs+0x6c/0x80
? __die+0x24/0x80
? page_fault_oops+0x154/0x570
? hrtimer_start_range_ns+0x142/0x4e0
? timerqueue_del+0x31/0x50
? do_user_addr_fault+0x4ac/0x880
? exc_page_fault+0x82/0x1d0
? asm_exc_page_fault+0x27/0x30
? regulator_enable+0x17/0x70
? __schedule+0x491/0x16b0
dmic_aif_event+0x82/0xa0 [snd_soc_dmic]
```
Adjust the error flow to explicitly set it back to NULL to avoid calling
regulator_enable() with garbage data.
Reported-by: Akshata V Unkal <Akshata.VUnkal@amd.com>
Fixes: d3321a20b5111 ("ASoC: dmic: add regulator support")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20250319145636.2401680-1-superm1@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/codecs/dmic.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/sound/soc/codecs/dmic.c b/sound/soc/codecs/dmic.c index 5d3c3f17c6d8..61e1bf1b3c9e 100644 --- a/sound/soc/codecs/dmic.c +++ b/sound/soc/codecs/dmic.c @@ -114,8 +114,12 @@ static int dmic_component_probe(struct snd_soc_component *component) return -ENOMEM; dmic->vref = devm_regulator_get_optional(component->dev, "vref"); - if (IS_ERR(dmic->vref) && PTR_ERR(dmic->vref) != -ENODEV) - return dev_err_probe(component->dev, PTR_ERR(dmic->vref), "Failed to get vref\n"); + if (IS_ERR(dmic->vref)) { + if (PTR_ERR(dmic->vref) != -ENODEV) + return dev_err_probe(component->dev, PTR_ERR(dmic->vref), + "Failed to get vref\n"); + dmic->vref = NULL; + } dmic->gpio_en = devm_gpiod_get_optional(component->dev, "dmicen", GPIOD_OUT_LOW); |