[bug report] ASoC: SOF: ipc4-control: Add support for generic bytes control

[bug report] ASoC: SOF: ipc4-control: Add support for generic bytes control

[Dan Carpenter]

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Peter Ujfalusi,

Commit 2a28b5240f2b ("ASoC: SOF: ipc4-control: Add support for
generic bytes control") from Dec 17, 2025 (linux-next), leads to the
following Smatch static checker warning:

	sound/soc/sof/ipc4-control.c:365 sof_ipc4_refresh_bytes_control()
	warn: missing error code here? '_dev_err()' failed. 'ret' = '0'

sound/soc/sof/ipc4-control.c
    324 static int
    325 sof_ipc4_refresh_bytes_control(struct snd_sof_control *scontrol, bool lock)
    326 {
    327         struct sof_ipc4_control_data *cdata = scontrol->ipc_control_data;
    328         struct snd_soc_component *scomp = scontrol->scomp;
    329         struct sof_ipc4_control_msg_payload *msg_data;
    330         struct sof_abi_hdr *data = cdata->data;
    331         struct sof_ipc4_msg *msg = &cdata->msg;
    332         size_t data_size;
    333         int ret = 0;
    334 
    335         if (!scontrol->comp_data_dirty)
    336                 return 0;
    337 
    338         if (!pm_runtime_active(scomp->dev))
    339                 return 0;
    340 
    341         data_size = scontrol->max_size - sizeof(*data);
    342         if (data_size < sizeof(*msg_data))
    343                 data_size = sizeof(*msg_data);
    344 
    345         msg_data = kzalloc(data_size, GFP_KERNEL);
    346         if (!msg_data)
    347                 return -ENOMEM;
    348 
    349         msg->extension = SOF_IPC4_MOD_EXT_MSG_PARAM_ID(data->type);
    350 
    351         msg_data->id = cdata->index;
    352         msg_data->num_elems = 0; /* ignored for bytes */
    353 
    354         msg->data_ptr = msg_data;
    355         msg->data_size = data_size;
    356 
    357         scontrol->comp_data_dirty = false;
    358         ret = sof_ipc4_set_get_kcontrol_data(scontrol, false, lock);
    359         if (!ret) {
    360                 if (msg->data_size > scontrol->max_size - sizeof(*data)) {
    361                         dev_err(scomp->dev,
    362                                 "%s: no space for data in %s (%zu, %zu)\n",
    363                                 __func__, scontrol->name, msg->data_size,
    364                                 scontrol->max_size - sizeof(*data));
--> 365                         goto out;

ret = -EINVAL;

    366                 }
    367 
    368                 data->size = msg->data_size;
    369                 scontrol->size = sizeof(*cdata) + sizeof(*data) + data->size;
    370                 memcpy(data->data, msg->data_ptr, data->size);
    371         } else {
    372                 dev_err(scomp->dev, "Failed to read control data for %s\n",
    373                         scontrol->name);
    374                 scontrol->comp_data_dirty = true;
    375         }
    376 
    377 out:
    378         msg->data_ptr = NULL;
    379         msg->data_size = 0;
    380 
    381         kfree(msg_data);
    382 
    383         return ret;
    384 }

regards,
dan carpenter

[bug report] ASoC: codecs: ACF bin parsing and check library file for aw88395

[Dan Carpenter]

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Weidong Wang,

Commit 4345865b003b ("ASoC: codecs: ACF bin parsing and check library
file for aw88395") from Jan 13, 2023 (linux-next), leads to the
following Smatch static checker warning:

	sound/soc/codecs/aw88395/aw88395_lib.c:712 aw_dev_create_prof_name_list_v1()
	warn: double check that we're allocating correct size: 8 vs 32

sound/soc/codecs/aw88395/aw88395_lib.c
    701 static int aw_dev_create_prof_name_list_v1(struct aw_device *aw_dev)
    702 {
    703         struct aw_prof_info *prof_info = &aw_dev->prof_info;
    704         struct aw_prof_desc *prof_desc = prof_info->prof_desc;
    705         int i;
    706 
    707         if (!prof_desc) {
    708                 dev_err(aw_dev->dev, "prof_desc is NULL");
    709                 return -EINVAL;
    710         }
    711 
--> 712         prof_info->prof_name_list = devm_kzalloc(aw_dev->dev,
    713                                         prof_info->count * PROFILE_STR_MAX,
                                                                   ^^^^^^^^^^^^^^^
PROFILE_STR_MAX this is the maximum length of the string but we only
need to allocate a pointer to the string sizeof(char *).  So this
allocates 32bytes instead of just 8.

It's a small waste of space but otherwise it's harmless.

    714                                         GFP_KERNEL);
    715         if (!prof_info->prof_name_list)
    716                 return -ENOMEM;
    717 
    718         for (i = 0; i < prof_info->count; i++) {
    719                 prof_desc[i].id = i;
    720                 prof_info->prof_name_list[i] = prof_desc[i].prf_str;
    721                 dev_dbg(aw_dev->dev, "prof name is %s", prof_info->prof_name_list[i]);
    722         }
    723 
    724         return 0;
    725 }

regards,
dan carpenter

[bug report] ASoC: SOF: sof-audio: Add support for loopback capture

[Dan Carpenter]

[ Smatch checking is paused while we raise funding. #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Ranjani Sridharan,

Commit c4b37c21c75d ("ASoC: SOF: sof-audio: Add support for loopback
capture") from Feb 4, 2026 (linux-next), leads to the following
Smatch static checker warning:

	sound/soc/sof/sof-audio.c:534 sof_prepare_widgets_in_path()
	error: uninitialized symbol 'widget_ops'.

sound/soc/sof/sof-audio.c
    478 static int
    479 sof_prepare_widgets_in_path(struct snd_sof_dev *sdev, struct snd_soc_dapm_widget *widget,
    480                             struct snd_pcm_hw_params *fe_params,
    481                             struct snd_sof_platform_stream_params *platform_params,
    482                             struct snd_pcm_hw_params *pipeline_params, int dir,
    483                             struct snd_soc_dapm_widget_list *list)
    484 {
    485         const struct sof_ipc_tplg_ops *tplg_ops = sof_ipc_get_ops(sdev, tplg);
    486         struct snd_sof_widget *swidget = widget->dobj.private;
    487         const struct sof_ipc_tplg_widget_ops *widget_ops;
    488         struct snd_soc_dapm_path *p;
    489         int ret;
    490 
    491         if (is_virtual_widget(sdev, widget, __func__))
    492                 return 0;
    493 
    494         if (!swidget)
    495                 goto sink_prepare;
                        ^^^^^^^^^^^^^^^^^
widget_ops is uninitialized.

    496 
    497         widget_ops = tplg_ops ? tplg_ops->widget : NULL;
    498         if (!widget_ops)
    499                 return 0;
    500 
    501         if (swidget->spipe && swidget->spipe->direction_valid &&
    502             !sof_widget_in_same_direction(swidget, dir))
    503                 return 0;
    504 
    505         /* skip widgets already prepared or aggregated DAI widgets*/
    506         if (!widget_ops[widget->id].ipc_prepare || swidget->prepared ||
    507             is_aggregated_dai(swidget))
    508                 goto sink_prepare;
    509 
    510         /* prepare the source widget */
    511         ret = widget_ops[widget->id].ipc_prepare(swidget, fe_params, platform_params,
    512                                              pipeline_params, dir);
    513         if (ret < 0) {
    514                 dev_err(sdev->dev, "failed to prepare widget %s\n", widget->name);
    515                 return ret;
    516         }
    517 
    518         swidget->prepared = true;
    519 
    520 sink_prepare:
    521         /* prepare all widgets in the sink paths */
    522         snd_soc_dapm_widget_for_each_sink_path(widget, p) {
    523                 if (!widget_in_list(list, p->sink))
    524                         continue;
    525 
    526                 if (!p->walking && p->sink->dobj.private) {
    527                         p->walking = true;
    528                         ret = sof_prepare_widgets_in_path(sdev, p->sink,  fe_params,
    529                                                           platform_params, pipeline_params, dir,
    530                                                           list);
    531                         p->walking = false;
    532                         if (ret < 0) {
    533                                 /* unprepare the source widget */
--> 534                                 if (widget_ops[widget->id].ipc_unprepare &&
    535                                     swidget && swidget->prepared && swidget->use_count == 0) {

We need to check that swidget is non-NULL first before checking
widget_ops[widget->id].ipc_unprepare, otherwise widget_ops is
uninitialized and it leads to a crash.

Wait, the zero day bot already reported this on Jan 5th.
https://lore.kernel.org/all/202512232221.Ub3HwrFz-lkp@intel.com/

    536                                         widget_ops[widget->id].ipc_unprepare(swidget);
    537                                         swidget->prepared = false;
    538                                 }
    539                                 return ret;
    540                         }
    541                 }
    542         }
    543 
    544         return 0;
    545 }

regards,
dan carpenter