Commit 0fcc43e2 authored by Cezary Rojewski's avatar Cezary Rojewski Committed by Takashi Iwai
Browse files

ALSA: hda: Fix null-ptr-deref when i915 fails and hdmi is denylisted 



If snd_hda_hdmi_codec module is denylisted and any event causes i915
enumeration to fail, is_likely_hdmi_codec() ends in null-ptr-deref.

As snd_soc_hda is an ASoC-based driver, its initialization is delayed
until all the necessary components appear in the system - allowing
actual sound card to enumerate. snd_hda_codec_configure() gets called by
the avs-driver core during probe_codecs() but the
snd_hda_codec_device_new(), necessary to complete codecs initialization,
happens only when codec-component of hda sound card is being probed.

Denylisting snd_hda_codec_hdmi module causes snd_hda_codec_configure()
to reach: codec_bind_generic() -> is_likely_hdmi_codec() which makes use
of ->wcaps and at this point the it isn't initialized yet - again,
requires completion of snd_hda_codec_device_new().

Signed-off-by: default avatarCezary Rojewski <cezary.rojewski@intel.com>
Link: https://lore.kernel.org/r/20220706120230.427296-3-cezary.rojewski@intel.com


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 61c606a4

sound/pci/hda/hda_bind.c

+7 −0
Original line number Original line Diff line number Diff line
@@ -248,6 +248,13 @@ static bool is_likely_hdmi_codec(struct hda_codec *codec) 
{

{

	hda_nid_t nid;

	hda_nid_t nid;





	/*

	 * For ASoC users, if snd_hda_hdmi_codec module is denylisted and any

	 * event causes i915 enumeration to fail, ->wcaps remains uninitialized.

	 */

	if (!codec->wcaps)

		return true;



	for_each_hda_codec_node(nid, codec) {

	for_each_hda_codec_node(nid, codec) {

		unsigned int wcaps = get_wcaps(codec, nid);

		unsigned int wcaps = get_wcaps(codec, nid);

		switch (get_wcaps_type(wcaps)) {

		switch (get_wcaps_type(wcaps)) {