* [PATCH 2/2] ALSA: hda/conexant: Add NULL check for dc_mode_path
2026-07-29 7:09 [PATCH 1/2] ALSA: hda/conexant: Fix EAPD pin array overflow wangdich9700
@ 2026-07-29 7:09 ` wangdich9700
2026-07-29 7:48 ` Takashi Iwai
2026-07-29 7:33 ` [PATCH 1/2] ALSA: hda/conexant: Fix EAPD pin array overflow Takashi Iwai
1 sibling, 1 reply; 4+ messages in thread
From: wangdich9700 @ 2026-07-29 7:09 UTC (permalink / raw)
To: tiwai, broonie, wangdich9700; +Cc: linux-sound, linux-kernel, wangdicheng
From: wangdicheng <wangdicheng@kylinos.cn>
snd_hda_add_new_path() returns NULL when no path exists between the
given NIDs, but olpc_xo_update_mic_pins() passes dc_mode_path
straight to snd_hda_activate_path() which dereferences it without
checking. Add the missing NULL guards, same as the local path
variable already has in the same function.
Signed-off-by: wangdicheng <wangdicheng@kylinos.cn>
---
sound/hda/codecs/conexant.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
index e7a2a073d22c..880fbbe5b643 100644
--- a/sound/hda/codecs/conexant.c
+++ b/sound/hda/codecs/conexant.c
@@ -451,7 +451,8 @@ static void olpc_xo_update_mic_pins(struct hda_codec *codec)
if (!spec->dc_enable) {
/* disable DC bias path and pin for port F */
update_mic_pin(codec, 0x1e, 0);
- snd_hda_activate_path(codec, spec->dc_mode_path, false, false);
+ if (spec->dc_mode_path)
+ snd_hda_activate_path(codec, spec->dc_mode_path, false, false);
/* update port B (ext mic) and C (int mic) */
/* OLPC defers mic widget control until when capture is
@@ -487,7 +488,8 @@ static void olpc_xo_update_mic_pins(struct hda_codec *codec)
update_mic_pin(codec, 0x1b, 0);
/* enable DC bias path and pin */
update_mic_pin(codec, 0x1e, spec->recording ? PIN_IN : 0);
- snd_hda_activate_path(codec, spec->dc_mode_path, true, false);
+ if (spec->dc_mode_path)
+ snd_hda_activate_path(codec, spec->dc_mode_path, true, false);
}
}
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH 1/2] ALSA: hda/conexant: Fix EAPD pin array overflow
2026-07-29 7:09 [PATCH 1/2] ALSA: hda/conexant: Fix EAPD pin array overflow wangdich9700
2026-07-29 7:09 ` [PATCH 2/2] ALSA: hda/conexant: Add NULL check for dc_mode_path wangdich9700
@ 2026-07-29 7:33 ` Takashi Iwai
1 sibling, 0 replies; 4+ messages in thread
From: Takashi Iwai @ 2026-07-29 7:33 UTC (permalink / raw)
To: wangdich9700; +Cc: tiwai, broonie, linux-sound, linux-kernel, wangdicheng
On Wed, 29 Jul 2026 09:09:34 +0200,
wangdich9700@163.com wrote:
>
> From: wangdicheng <wangdicheng@kylinos.cn>
>
> The bounds check in cx_auto_parse_eapd() happens after the write,
> so when a codec has more than 4 EAPD pins the 5th one gets written
> to eapds[4] which is past the end of the array and clobbers the
> adjacent dynamic_eapd field.
No, it checks right after the increment, then aborts the loop. So any
overwrite won't happen.
Takashi
>
> Signed-off-by: wangdicheng <wangdicheng@kylinos.cn>
> ---
> sound/hda/codecs/conexant.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
> index 40da2832ba66..e7a2a073d22c 100644
> --- a/sound/hda/codecs/conexant.c
> +++ b/sound/hda/codecs/conexant.c
> @@ -100,9 +100,9 @@ static void cx_auto_parse_eapd(struct hda_codec *codec)
> continue;
> if (!(snd_hda_query_pin_caps(codec, nid) & AC_PINCAP_EAPD))
> continue;
> - spec->eapds[spec->num_eapds++] = nid;
> if (spec->num_eapds >= ARRAY_SIZE(spec->eapds))
> break;
> + spec->eapds[spec->num_eapds++] = nid;
> }
>
> /* NOTE: below is a wild guess; if we have more than two EAPDs,
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread