[broonie-sound:for-7.4 37/72] sound/soc/soc-dapm.c:2893 snd_soc_dapm_free_widget() warn: variable dereferenced before check 'w->dapm' (see line 2891)

[Dan Carpenter <error27@gmail.com>]

Sorry for sending this without a subject...  :(

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-7.4
head:   ba982c33278c1fc739c8c220f410d6539de9d9b9
commit: 568406bc832e7e9e333e2ab05aafd0b83ffb9610 [37/72] ASoC: soc-dapm: Remove widget from cache on removal
config: nios2-randconfig-r2202-20261017 (https://download.01.org/0day-ci/archive/20261018/202610180339.A6POXeNa-lkp@intel.com/config)
compiler: nios2-linux-gcc (GCC) 11.5.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202610180339.A6POXeNa-lkp@intel.com/

smatch warnings:
sound/soc/soc-dapm.c:2893 snd_soc_dapm_free_widget() warn: variable dereferenced before check 'w->dapm' (see line 2891)

vim +2893 sound/soc/soc-dapm.c

b97e26980f6c13 Lars-Peter Clausen   2015-07-21  2870  void snd_soc_dapm_free_widget(struct snd_soc_dapm_widget *w)
2b97eabc09f42d Richard Purdie       2006-10-06  2871  {
568406bc832e7e Amadeusz Sławiński   2026-10-14  2872  	struct snd_soc_dapm_context *d;
2b97eabc09f42d Richard Purdie       2006-10-06  2873  	struct snd_soc_dapm_path *p, *next_p;
a3423b02cf745c Lars-Peter Clausen   2015-08-11  2874  	enum snd_soc_dapm_direction dir;
2b97eabc09f42d Richard Purdie       2006-10-06  2875  
1c9096f32ad23f Kuninori Morimoto    2022-10-17  2876  	if (!w)
1c9096f32ad23f Kuninori Morimoto    2022-10-17  2877  		return;
1c9096f32ad23f Kuninori Morimoto    2022-10-17  2878  
2b97eabc09f42d Richard Purdie       2006-10-06  2879  	list_del(&w->list);
5c6679b5cb120f Thomas Hebb          2020-12-12  2880  	list_del(&w->dirty);
8ddab3f5107c39 Jarkko Nikula        2010-12-14  2881  	/*
8ddab3f5107c39 Jarkko Nikula        2010-12-14  2882  	 * remove source and sink paths associated to this widget.
8ddab3f5107c39 Jarkko Nikula        2010-12-14  2883  	 * While removing the path, remove reference to it from both
8ddab3f5107c39 Jarkko Nikula        2010-12-14  2884  	 * source and sink widgets so that path is removed only once.
8ddab3f5107c39 Jarkko Nikula        2010-12-14  2885  	 */
af6d53db28e644 Kuninori Morimoto    2026-01-20  2886  	dapm_for_each_direction(dir) {
a3423b02cf745c Lars-Peter Clausen   2015-08-11  2887  		snd_soc_dapm_widget_for_each_path_safe(w, dir, p, next_p)
8872293fc38c49 Lars-Peter Clausen   2013-06-14  2888  			dapm_free_path(p);
a3423b02cf745c Lars-Peter Clausen   2015-08-11  2889  	}
8872293fc38c49 Lars-Peter Clausen   2013-06-14  2890  
8ad13cdc92f663 Trevor Wu            2023-05-26 @2891  	dapm_debugfs_free_widget(w);
                                                                                 ^
This dereferences "w->dapm"

8ad13cdc92f663 Trevor Wu            2023-05-26  2892  
568406bc832e7e Amadeusz Sławiński   2026-10-14 @2893  	if (w->dapm) {
                                                            ^^^^^^^
So this check is too late.

568406bc832e7e Amadeusz Sławiński   2026-10-14  2894  		if (w->dapm->card) {
568406bc832e7e Amadeusz Sławiński   2026-10-14  2895  			for_each_card_dapms(w->dapm->card, d) {

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki