NULL ptr dereference in cs42l43/cs35l56 on Lenovo Yoga 7 Slim laptop

["Krzysztof Hałasa" <khalasa@piap.pl>]

Hello,

I'm trying to use some audio on a certain new laptop:
DMI: LENOVO 83R0/LNVNB161216, BIOS UCCN16WW 08/07/2026. Aka Yoga 7 Slim
14ILL11 or something like that. Also LENOVO_MT_83R0_BU_idea_FM_Yoga
Slim 7 14ILL11.
Linux version 7.4.0-rc2+
Ubuntu 26.04.01 LTS.
Kernel config is copied from Ubuntu 26.04.01 LTS test kernel.
Lots of ACPI errors in dmesg.

Oops: general protection fault, kernel NULL pointer dereference 0x38: 0000 [#1] SMP NOPTI
CPU: 5 UID: 0 PID: 797 Comm: (udev-worker) Tainted: G E 7.4.0-rc2+ #1 PREEMPT(lazy)
Tainted: [E]=UNSIGNED_MODULE
Hardware name: LENOVO 83R0/LNVNB161216, BIOS UCCN16WW 08/07/2026
RIP: 0010:snd_soc_card_get_kcontrol.cold+0x73/0xe3 [snd_soc_core]
Code: d2 6b 39 c1 e8 1d 03 96 fa 4c 8b 45 a0 4c 8b 4d a8 31 c0 b9 10 00 00 00 48 8d 7d b0 be 2c 00 00 00 f3 ab 4c 89 c7 4c 89 45 a8 <49> 8b 59 38 c7 45 b4 02 00 00 00 e8 bc 68 fa fb 4c 8b 45 a8 48 83
RSP: 0018:ffffd4bec5aef418 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8df1c6668e38 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 000000000000002c RDI: ffffd4bec5aef48c
RBP: ffffd4bec5aef478 R08: ffffd4bec5aef48c R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffc284a835
R13: 0000000000000005 R14: ffff8df1c6668e38 R15: 0000000000000000
FS:  000074609ecccc80(0000) GS:ffff8df57084b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000073f68f08e250 CR3: 00000001a07ff003 CR4: 0000000008f72ef0
PKRU: 55555554
Call Trace:
 <TASK>
 snd_soc_component_get_kcontrol+0x88/0xd0 [snd_soc_core]
 cs42l43_dai_probe+0xb3/0x150 [snd_soc_cs42l43]
 snd_soc_pcm_dai_probe+0x5a/0xe0 [snd_soc_core]
 snd_soc_bind_card+0x6f5/0xda0 [snd_soc_core]
 call_soc_bind_card+0x69/0xf0 [snd_soc_core]
 snd_soc_component_register+0x19b/0x2f0 [snd_soc_core]
 ? snd_soc_component_new+0xc1/0x110 [snd_soc_core]
 snd_soc_register_component+0x32/0x50 [snd_soc_core]
 cs35l56_component_register+0x42/0x7e [snd_soc_cs35l56]
 cs35l56_common_probe+0x7ba/0x88a [snd_soc_cs35l56]
 cs35l56_spi_probe+0xc3/0xe0 [snd_soc_cs35l56_spi]
 spi_probe+0x62/0xe0
 really_probe+0xff/0x3c0
 __driver_probe_device+0xad/0x1e0
 ? spi_match_device+0xe6/0x110
 driver_probe_device+0x24/0xb0
 ? __pfx___driver_attach+0x10/0x10
 __driver_attach+0xf8/0x260
 ? __pfx___driver_attach+0x10/0x10
 bus_for_each_dev+0x93/0x100
 driver_attach+0x1e/0x30
 bus_add_driver+0x1fd/0x2a0
 driver_register+0x75/0xf0
 __spi_register_driver+0xaf/0x100
 ? __pfx_init_module+0x10/0x10 [snd_soc_cs35l56_spi]
 cs35l56_spi_driver_init+0x1c/0xff0 [snd_soc_cs35l56_spi]
 do_one_initcall+0x81/0x3f0
 do_init_module+0x93/0x2c0
 load_module+0x2239/0x2660
 ? ima_post_read_file+0x11a/0x1a0
 ? security_kernel_post_read_file+0x70/0x1e0
 init_module_from_file+0xf0/0x1d0
 idempotent_init_module+0x218/0x340
 __x64_sys_finit_module+0x7c/0x110
 x64_sys_call+0xfbc/0x23d0
 do_syscall_64+0xbd/0x570
 ? vfs_read+0x1b2/0x460
 ? vfs_read+0x1b2/0x460
 ? ksys_pread64+0x5c/0xd0
 ? do_syscall_64+0x293/0x570
 ? __x64_sys_newfstatat+0x1c/0x30
 ? x64_sys_call+0x2074/0x23d0
 ? do_syscall_64+0xfa/0x570
 ? __x64_sys_finit_module+0x7c/0x110
 ? do_syscall_64+0x293/0x570
 ? putname+0x41/0x90
 ? do_sys_openat2+0x75/0xf0
 ? __x64_sys_openat+0x5f/0xa0
 ? x64_sys_call+0x1a20/0x23d0
 ? do_syscall_64+0xfa/0x570
 ? exc_page_fault+0x9d/0x1d0
 ? do_syscall_64+0x33/0x570
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x74609e534acd
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 0b d3 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd1c5fa158 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000062a3e7400e50 RCX: 000074609e534acd
RDX: 0000000000000000 RSI: 000074609e63d317 RDI: 000000000000002c
RBP: 00007ffd1c5fa1f0 R08: 0000000000000000 R09: 000062a3e7529fb0
R10: 0000000000000000 R11: 0000000000000246 R12: 000074609e63d317
R13: 000062a3e7378770 R14: 0000000000020000 R15: 0000000000000000
 </TASK>
Modules linked in: many
---[ end trace 0000000000000000 ]---
RIP: 0010:snd_soc_card_get_kcontrol.cold+0x73/0xe3 [snd_soc_core]
Code: d2 6b 39 c1 e8 1d 03 96 fa 4c 8b 45 a0 4c 8b 4d a8 31 c0 b9 10 00 00 00 48 8d 7d b0 be 2c 00 00 00 f3 ab 4c 89 c7 4c 89 45 a8 <49> 8b 59 38 c7 45 b4 02 00 00 00 e8 bc 68 fa fb 4c 8b 45 a8 48 83
RSP: 0018:ffffd4bec5aef418 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8df1c6668e38 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 000000000000002c RDI: ffffd4bec5aef48c
RBP: ffffd4bec5aef478 R08: ffffd4bec5aef48c R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffc284a835
R13: 0000000000000005 R14: ffff8df1c6668e38 R15: 0000000000000000
FS:  000074609ecccc80(0000) GS:ffff8df5706cb000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000062a3e720ea78 CR3: 00000001a07ff006 CR4: 0000000008f72ef0


Tried 7.3.something first, no NULL ptr dereferences, but it tried to
talk with some ghost rt711-sdca chip, and the sound didn't work either.
7.2.x, there were some topology problems or something, apparently that
was fixed in the tree.

Added some pr_crit()s:

sof-audio-pci-intel-lnl 0000:00:1f.3: enabling device (0000 -> 0002)
sof-audio-pci-intel-lnl 0000:00:1f.3: DSP detected with PCI class/subclass/prog-if 0x040100
sof-audio-pci-intel-lnl 0000:00:1f.3: bound 0000:00:02.0 (ops intel_audio_component_bind_ops [xe])
sof-audio-pci-intel-lnl 0000:00:1f.3: use msi interrupt mode
cs42l43 sdw:0:0:01fa:4243:01: supply vdd-p not found, using dummy regulator
cs42l43 sdw:0:0:01fa:4243:01: supply vdd-d not found, using dummy regulator
cs42l43 sdw:0:0:01fa:4243:01: supply vdd-a not found, using dummy regulator
cs42l43 sdw:0:0:01fa:4243:01: supply vdd-io not found, using dummy regulator
cs42l43 sdw:0:0:01fa:4243:01: supply vdd-cp not found, using dummy regulator
sof-audio-pci-intel-lnl 0000:00:1f.3: No SoundWire machine driver found for the ACPI-reported configuration:
sof-audio-pci-intel-lnl 0000:00:1f.3: link 0 mfg_id 0x01fa part_id 0x4243 version 0x3
sof-audio-pci-intel-lnl 0000:00:1f.3: Use SoundWire default machine driver with function topologies
sof-audio-pci-intel-lnl 0000:00:1f.3: hda codecs found, mask 4
sof-audio-pci-intel-lnl 0000:00:1f.3: NHLT device BT(0) detected, ssp_mask 0x4
sof-audio-pci-intel-lnl 0000:00:1f.3: BT link detected in NHLT tables: 0x4
sof-audio-pci-intel-lnl 0000:00:1f.3: DMICs detected in NHLT tables: 4
cs42l43 sdw:0:0:01fa:4243:01: devid: 0x042a43, rev: 0xa1, otp: 0x03
sof-audio-pci-intel-lnl 0000:00:1f.3: Firmware paths/files for ipc type 1:
sof-audio-pci-intel-lnl 0000:00:1f.3:  Firmware file:     intel/sof-ipc4/lnl/sof-lnl.ri
sof-audio-pci-intel-lnl 0000:00:1f.3:  Firmware lib path: intel/sof-ipc4-lib/lnl
sof-audio-pci-intel-lnl 0000:00:1f.3:  Topology file:     function topologies
sof-audio-pci-intel-lnl 0000:00:1f.3: Loaded firmware library: ADSPFW, version: 2.14.1.1
Adding alias for supply vdd-amp,(null) -> vdd-amp,sdw:0:0:01fa:4243:01
cs35l56_spi_probe
cs35l56_common_probe
cs35l56 spi-cs35l56-left: supply VDD_P not found, using dummy regulator
cs35l56 spi-cs35l56-left: supply VDD_IO not found, using dummy regulator
cs35l56 spi-cs35l56-left: supply VDD_A not found, using dummy regulator
cs35l56_common_probe: about to call cs35l56_init()
cs35l56 spi-cs35l56-left: Cirrus Logic CS35L56 Rev B0 OTP3 fw:3.4.4 (patched=0)
sof-audio-pci-intel-lnl 0000:00:1f.3: Booted firmware version: 2.14.1.1
cs35l56_common_probe: about to call cs35l56_component_register()
cs35l56_component_register
cs35l56_spi_probe
cs35l56_common_probe
cs35l56 spi-cs35l56-right: supply VDD_P not found, using dummy regulator
cs35l56 spi-cs35l56-right: supply VDD_IO not found, using dummy regulator
cs35l56 spi-cs35l56-right: supply VDD_A not found, using dummy regulator
cs35l56_common_probe: about to call cs35l56_init()
cs35l56 spi-cs35l56-right: Cirrus Logic CS35L56 Rev B0 OTP3 fw:3.4.4 (patched=0)
cs35l56_common_probe: about to call cs35l56_component_register()
cs35l56_component_register
snd_soc_component_get_kcontrol(Speaker Digital Switch, name = Speaker Digital Switch): component->card is NULL, expect problems
snd_soc_card_get_kcontrol(): name: "Speaker Digital Switch"
soc_card: NULL
Oops: general protection fault, kernel NULL pointer dereference follows.

What are my options?

Additional info available on request. This is not my laptop, though.
-- 
Krzysztof "Chris" Hałasa

Łukasiewicz Research Network
Industrial Research Institute for Automation and Measurements PIAP

Al. Jerozolimskie 202, 02-486 Warsaw, Poland