Linux Sound subsystem development
 help / color / mirror / Atom feed
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
To: lgirdwood@gmail.com, broonie@kernel.org
Cc: linux-sound@vger.kernel.org, kai.vehmanen@linux.intel.com,
	ranjani.sridharan@linux.intel.com,
	yung-chuan.liao@linux.intel.com, pierre-louis.bossart@linux.dev,
	liam.r.girdwood@intel.com, mateuszx.redzynia@intel.com
Subject: [PATCH 09/10] ASoC: SOF: Intel: hda: Fix NULL pointer dereference
Date: Wed,  4 Feb 2026 10:18:32 +0200	[thread overview]
Message-ID: <20260204081833.16630-10-peter.ujfalusi@linux.intel.com> (raw)
In-Reply-To: <20260204081833.16630-1-peter.ujfalusi@linux.intel.com>

From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>

If there's a mismatch between the DAI links in the machine driver and
the topology, it is possible that the playback/capture widget is not
set, especially in the case of loopback capture for echo reference
where we use the dummy DAI link. Return the error when the widget is not
set to avoid a null pointer dereference like below when the topology is
broken.

RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]

Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Mateusz Redzynia <mateuszx.redzynia@intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
---
 sound/soc/sof/intel/hda-dai.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c
index 883d0d3bae9e..3c742d535133 100644
--- a/sound/soc/sof/intel/hda-dai.c
+++ b/sound/soc/sof/intel/hda-dai.c
@@ -70,12 +70,22 @@ static const struct hda_dai_widget_dma_ops *
 hda_dai_get_ops(struct snd_pcm_substream *substream, struct snd_soc_dai *cpu_dai)
 {
 	struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream);
-	struct snd_sof_widget *swidget = w->dobj.private;
+	struct snd_sof_widget *swidget;
 	struct snd_sof_dev *sdev;
 	struct snd_sof_dai *sdai;
 
-	sdev = widget_to_sdev(w);
+	/*
+	 * this is unlikely if the topology and the machine driver DAI links match.
+	 * But if there's a missing DAI link in topology, this will prevent a NULL pointer
+	 * dereference later on.
+	 */
+	if (!w) {
+		dev_err(cpu_dai->dev, "%s: widget is NULL\n", __func__);
+		return NULL;
+	}
 
+	sdev = widget_to_sdev(w);
+	swidget = w->dobj.private;
 	if (!swidget) {
 		dev_err(sdev->dev, "%s: swidget is NULL\n", __func__);
 		return NULL;
-- 
2.52.0


  parent reply	other threads:[~2026-02-04  8:18 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-02-04  8:18 [PATCH 00/10] ASoC: SOF: Support for echoref (virtual DAI) Peter Ujfalusi
2026-02-04  8:18 ` [PATCH 01/10] ASoC: SOF: sof-audio: Add a new op in struct sof_ipc_tplg_ops Peter Ujfalusi
2026-02-04  8:18 ` [PATCH 02/10] ASoC: SOF: pcm: Split up widget prepare and setup Peter Ujfalusi
2026-02-04  8:18 ` [PATCH 03/10] uapi: sound: sof: tokens: Add missing token for KCPS Peter Ujfalusi
2026-02-04  8:18 ` [PATCH 04/10] ASoC: Intel: sof_sdw: Add a DAI link for loopback capture Peter Ujfalusi
2026-02-04  8:18 ` [PATCH 05/10] ASoC: SOF: ipc4-topology: Add new tokens for pipeline direction Peter Ujfalusi
2026-02-04  8:18 ` [PATCH 06/10] ASoC: SOF: ipc4-topology: Add support for process modules with no input pins Peter Ujfalusi
2026-02-04  8:18 ` [PATCH 07/10] ASoC: SOF: sof-audio: Traverse paths with aggregated DAI widgets Peter Ujfalusi
2026-02-04  8:18 ` [PATCH 08/10] ASoC: SOF: sof-audio: Add support for loopback capture Peter Ujfalusi
2026-02-04  8:18 ` Peter Ujfalusi [this message]
2026-02-04  8:18 ` [PATCH 10/10] ASoC: SOF: Intel: hda: Add a virtual CPU DAI Peter Ujfalusi
2026-02-05 11:04 ` [PATCH 00/10] ASoC: SOF: Support for echoref (virtual DAI) Mark Brown

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260204081833.16630-10-peter.ujfalusi@linux.intel.com \
    --to=peter.ujfalusi@linux.intel.com \
    --cc=broonie@kernel.org \
    --cc=kai.vehmanen@linux.intel.com \
    --cc=lgirdwood@gmail.com \
    --cc=liam.r.girdwood@intel.com \
    --cc=linux-sound@vger.kernel.org \
    --cc=mateuszx.redzynia@intel.com \
    --cc=pierre-louis.bossart@linux.dev \
    --cc=ranjani.sridharan@linux.intel.com \
    --cc=yung-chuan.liao@linux.intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox