Re: [PATCH 2/5] ASoC: Intel: avs: Cleanup duplicate members

[Cezary Rojewski <cezary.rojewski@intel.com>]

On 2025-08-30 12:55 AM, Nathan Chancellor wrote:
> Hi Cezary,
> 
> On Wed, Aug 27, 2025 at 04:22:26PM +0200, Cezary Rojewski wrote:
>> Switch to the new board registration functions and remove the
>> then-unused code.
>>
>> The SSP-number-check is still important and cannot be just dropped. Move
>> it from avs_register_i2s_board(), which is being removed with this
>> patch, to avs_register_i2s_boards() to maintain sanity when registering
>> a board.
>>
>> Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
>> Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
> 
> I just bisected a new NULL pointer dereference BUG on an old Chromebox
> to this change as commit 6acfaee44cbe ("ASoC: Intel: avs: Cleanup
> duplicate members") in next-20250829.

(...)

>    git bisect bad a37280daa4d583c7212681c49b285de9464a5200
>    # bad: [6acfaee44cbe9364a91dcc373fb4e6e395c5b20b] ASoC: Intel: avs: Cleanup duplicate members
>    git bisect bad 6acfaee44cbe9364a91dcc373fb4e6e395c5b20b
>    # good: [3351e814cb49dff7ef4808f5ebfb299162994118] ASoC: Intel: avs: New board registration routines
>    git bisect good 3351e814cb49dff7ef4808f5ebfb299162994118
>    # first bad commit: [6acfaee44cbe9364a91dcc373fb4e6e395c5b20b] ASoC: Intel: avs: Cleanup duplicate members
> 
>    [    0.000000] Linux version 6.17.0-rc2-debug-00065-g6acfaee44cbe (nathan@ax162) (x86_64-linux-gcc (GCC) 15.2.0, GNU ld (GNU Binutils) 2.45) #1 SMP PREEMPT_DYNAMIC Fri Aug 29 15:20:49 MST 2025
>    ...
>    [    5.021907] BUG: kernel NULL pointer dereference, address: 0000000000000078
>    [    5.022559] #PF: supervisor read access in kernel mode
>    [    5.023201] #PF: error_code(0x0000) - not-present page
>    [    5.023671] PGD 0 P4D 0
>    [    5.024135] Oops: Oops: 0000 [#1] SMP PTI
>    [    5.024600] CPU: 1 UID: 0 PID: 331 Comm: (udev-worker) Not tainted 6.17.0-rc2-debug-00065-g6acfaee44cbe #1 PREEMPT(full)  d53566f3620e7aa5231643b0a073759aa0a44325
>    [    5.025086] Hardware name: Google Teemo/Teemo, BIOS MrChromebox-2503.0 04/27/2025
>    [    5.025575] RIP: 0010:avs_probe_mb_probe+0x81/0x120 [snd_soc_avs_probe]

(...)

> If there is any other additional information I can provide or patches I
> can test, I am more than happy to do so.

Hi Nathan,

Thank you for the report - the form of your message made it easy to find 
the root cause, much appreciated. Hint pointed out by Amadeusz - try 
with probe-board disabled - sheds even more light on the problem.

Below diff is enough to address the null-ptr-deref:

diff --git a/sound/soc/intel/avs/board_selection.c 
b/sound/soc/intel/avs/board_selection.c
index 52e6266a7cb8..6412b0a010fa 100644
--- a/sound/soc/intel/avs/board_selection.c
+++ b/sound/soc/intel/avs/board_selection.c
@@ -438,9 +438,10 @@ static struct platform_device 
*avs_register_board_pdata(struct avs_dev *adev, co

  static int __maybe_unused avs_register_probe_board(struct avs_dev *adev)
  {
+       struct snd_soc_acpi_mach mach = {{0}};
         struct platform_device *pdev;

-       pdev = avs_register_board(adev, "avs_probe_mb", NULL, 0);
+       pdev = avs_register_board(adev, "avs_probe_mb", &mach, 
sizeof(mach));
         if (IS_ERR(pdev))
                 return PTR_ERR(pdev);
(end)

However, I do not believe that's the 'correct' way to proceed. The 
patchset of 5 is part of a larger series which I decided to split into 
smaller chunks to make it easier to review. Unfortunately, looks like I 
failed here and should have published a larger series instead. Even if 
harder to review, brings no problems as one observed above.

I see two options here:
a) revert this patchset and I'll simply sent a new, larger series
b) no revert and I'm sending the rest (~15 patches) to linux-sound

I believe Mark makes the call here, I'll follow up as required of me.

Kind regards,
Czarek