From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F0678403EAE; Wed, 20 May 2026 18:49:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779302965; cv=none; b=R1nTQqI3PjnCTR988iXen8v6NcrJY7G3E24frUkyIMFvKXPSc6YhNtMQf7/rvZU/ZFX3mE2teDGHYxpox8s4zWnq2d/v2HPHLcM2VKnDwEgd7Wr5QzqLFi8q/vdlkzd7kx/nJrWKsN1z5LpCP6EEKVGiR5hGz5nrfinjwx/i/7o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779302965; c=relaxed/simple; bh=yw8Tr7JfZknYcnyypW7rjEI3+vHNiNrr9kOrw17m0Dc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bLmSxKJ073hquCXZI74JBz2jbFSc6291lv0d0bSwVLZsWNyXIGoHQjjqvm2Fj4fB4Rarb7f7n+wrbcxN2MBA+j4vWZ/QDrW1KD6WXDOtrA6t/6XgKg0sAMTOGK1d+7WYzxYkbUiGKr/G+z7PZvtUfShGw4J0ZJ7RKzZyZJdd65o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=P56i1nru; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="P56i1nru" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2E2841F000E9; Wed, 20 May 2026 18:49:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779302961; bh=HOTlXKMnAyYHrsqcBNyI3hndbQBLGYijb3HwToAELTw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=P56i1nrul+I3DjD5mgBuZU08rstYIZTdzGq6mcOE24tbpwMU2bQ2GQeYWdpln1nSW vRM94Xx2EHKTl775/a0N8C+BiXVXn0z6lPC5on7aLsuYd3CTYnWjMQsAflk7GHydVK 61QxbGeV67/xBB7yZPE6SdGM3BRKUFR38soNBtGo= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ranjani Sridharan , Bard Liao , Liam Girdwood , Mateusz Redzynia , Peter Ujfalusi , Mark Brown , Alva Lan , Sasha Levin Subject: [PATCH 6.6 465/508] ASoC: SOF: Intel: hda: Fix NULL pointer dereference Date: Wed, 20 May 2026 18:24:48 +0200 Message-ID: <20260520162108.673580537@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260520162058.573354582@linuxfoundation.org> References: <20260520162058.573354582@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ranjani Sridharan [ Upstream commit 16c589567a956d46a7c1363af3f64de3d420af20 ] If there's a mismatch between the DAI links in the machine driver and the topology, it is possible that the playback/capture widget is not set, especially in the case of loopback capture for echo reference where we use the dummy DAI link. Return the error when the widget is not set to avoid a null pointer dereference like below when the topology is broken. RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common] Signed-off-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Liam Girdwood Reviewed-by: Mateusz Redzynia Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-10-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown Signed-off-by: Alva Lan Signed-off-by: Sasha Levin --- sound/soc/sof/intel/hda-dai.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c index 1fe7cce160913..a3d0b6d721aaf 100644 --- a/sound/soc/sof/intel/hda-dai.c +++ b/sound/soc/sof/intel/hda-dai.c @@ -77,12 +77,22 @@ static const struct hda_dai_widget_dma_ops * hda_dai_get_ops(struct snd_pcm_substream *substream, struct snd_soc_dai *cpu_dai) { struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream); - struct snd_sof_widget *swidget = w->dobj.private; + struct snd_sof_widget *swidget; struct snd_sof_dev *sdev; struct snd_sof_dai *sdai; - sdev = widget_to_sdev(w); + /* + * this is unlikely if the topology and the machine driver DAI links match. + * But if there's a missing DAI link in topology, this will prevent a NULL pointer + * dereference later on. + */ + if (!w) { + dev_err(cpu_dai->dev, "%s: widget is NULL\n", __func__); + return NULL; + } + sdev = widget_to_sdev(w); + swidget = w->dobj.private; if (!swidget) { dev_err(sdev->dev, "%s: swidget is NULL\n", __func__); return NULL; -- 2.53.0