Re: [PATCH v3 1/9] ASoC: loongson: Fix error handling in ACPI property parsing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver statically allocates global variables (`codec_name`, `loongson_dai_links`) and modifies them locklessly during the device probe phase without creating instance-specific copies. This leads to data races, state corruption on probe deferral, and a use-after-free vulnerability upon device unbind.
--

commit b0aab833787c20534a1a8d5a4fb96b7f089e37e4
Author: Binbin Zhou <zhoubinbin@loongson.cn>

ASoC: loongson: Fix error handling in ACPI property parsing

This commit fixes a missing error check for device_property_read_string()
in loongson_card_parse_acpi(). It propagates the error if the codec-dai-name
property is missing or invalid, preventing the use of an uninitialized
pointer.

Closes: https://sashiko.dev/#/patchset/cover.1780538113.git.zhoubinbin@loongson.cn?part=5

> diff --git a/sound/soc/loongson/loongson_card.c b/sound/soc/loongson/loongson_card.c
> --- a/sound/soc/loongson/loongson_card.c
> +++ b/sound/soc/loongson/loongson_card.c

[ ... ]

> @@ -108,7 +108,9 @@ static int loongson_card_parse_acpi(struct loongson_card_data *data)
>  		return -ENOENT;
>  	snprintf(codec_name, sizeof(codec_name), "i2c-%s", acpi_dev_name(adev));
>  
> -	device_property_read_string(card->dev, "codec-dai-name", &codec_dai_name);
> +	ret = device_property_read_string(card->dev, "codec-dai-name", &codec_dai_name);
> +	if (ret)
> +		return ret;
>  
>  	for (i = 0; i < card->num_links; i++) {
>  		loongson_dai_links[i].platforms->name = dev_name(phy_dev);

[Severity: High]
This is a pre-existing issue, but I noticed that loongson_dai_links appears
to be a statically allocated global array being modified locklessly here with
instance-specific pointers like dev_name(phy_dev).

If the device is unbound, could this leave a dangling pointer in the global
array?

Additionally, if multiple audio cards are instantiated, could they overwrite
each other's state in this shared array?

Similarly, in loongson_card_parse_of(), snd_soc_of_get_dlc() acquires a
reference to an of_node and stores it in this global array. If probe defers,
does the error path fail to clean up the globally stored refcount, causing
a memory leak?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1782439646.git.zhoubinbin@loongson.cn?part=1