kernel/linux.git/sound/soc/sdca, branch linux-7.1.y

ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions

2026-06-11T14:55:23+00:00

sdca_dev_unregister_functions() iterates over all SDCA function descriptors and calls sdca_dev_unregister() on each func_dev without checking for NULL. When a function registration has failed partway through, or the device cleanup races with probe deferral, func_dev entries may be NULL, leading to a kernel oops: BUG: kernel NULL pointer dereference, address: 0000000000000040 RIP: 0010:device_del+0x1e/0x3e0 Call Trace: sdca_dev_unregister_functions+0x37/0x60 [snd_soc_sdca] release_nodes+0x35/0xb0 devres_release_all+0x90/0x100 device_unbind_cleanup+0xe/0x80 device_release_driver_internal+0x1c1/0x200 bus_remove_device+0xc6/0x130 device_del+0x161/0x3e0 device_unregister+0x17/0x60 sdw_delete_slave+0xb6/0xd0 [soundwire_bus] sdw_bus_master_delete+0x1e/0x50 [soundwire_bus] ... sof_probe_work+0x19/0x30 [snd_sof] This was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake) with the SOF audio driver probe failing due to missing Panther Lake firmware, causing the subsequent cleanup of SoundWire devices to trigger the crash. Fix this with three changes: 1) Add a NULL guard in sdca_dev_unregister() so that callers do not need to pre-validate the pointer (defense in depth). 2) In sdca_dev_unregister_functions(), skip NULL func_dev entries and clear func_dev to NULL after unregistration, making the function idempotent and safe against double-invocation. 3) In sdca_dev_register_functions(), roll back all previously registered functions when a later one fails, so the function array is never left in a partially-populated state. Fixes: 4496d1c65bad ("ASoC: SDCA: add function devices") Signed-off-by: Kean Ren Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260611023757.1553960-1-rh_king@163.com Signed-off-by: Mark Brown

ASoC: Correct bug parsing DisCo booleans

2026-04-20T17:40:07+00:00

Charles Keepax says: MIPI DisCo uses the unfortunate convention of allowing boolean properties to be present but having a zero value. Opposed to the normal convention of simply not specifying the property. Fix an issue in the SDCA code where mipi-sdca-control-deferrable is not parsed correctly. However, we also have some shipping ACPIs where these properties are not specified correctly. Update the MBQ regmap to attempt defers albeit with a warning in the case where a control attempts to defer but is not marked at such. There is little down side to this as if defer is genuinely not supported then the control will just return the same error again.

ASoC: SDCA: Fix reading of mipi-sdca-control-deferrable

2026-04-20T17:40:03+00:00

The discussion in [1] highlighted that the SDCA code shouldn't be using fwnode_property_read_bool() for DisCo controls, as the spec allows setting the value to zero meaning the property should not be used. Correct a small bug in the SDCA code that will mark such controls as deferrable. Link: https://lore.kernel.org/linux-sound/20260311142153.2201761-1-rf@opensource.cirrus.com/ [1] Fixes: 42b144cb6a2d ("ASoC: SDCA: Add SDCA Control parsing") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260413124621.1345315-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown

ASoC: SDCA: Update text of FIXME

2026-04-10T11:01:29+00:00

A couple of attempts to correct this FIXME have been sent upstream but the situation is not quite a simple as the FIXME implies. Update the FIXME to include a better description of the situation. Link: https://lore.kernel.org/linux-sound/20260408085607.3813488-1-shumingf@realtek.com/ Link: https://lore.kernel.org/linux-sound/20260324-sdca-function-status-init-irq-v1-1-bba49417a4e0@gmail.com/ Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260410104500.163337-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown

ASoC: Yet another round of SDCA fixes

2026-04-09T18:39:32+00:00

Charles Keepax says: Another round of SDCA fixes a couple of fix to the IRQ cleanup from Richard, and a minor tweak to the IRQ handling from me.

ASoC: SDCA: Tidy up irq_enable_flags()/sdca_irq_disable()

2026-04-09T18:39:31+00:00

In irq_enable_flags() and sdca_irq_disable() there is a NULL check on the interrupt data pointer, however this is just pulled from an array so can never be NULL. This was likely left over from an earlier version that looked up the data in a different way. Replace the check with checking for the IRQ itself being non-zero. Whilst here also drop the sdca_interrupt structure down into the loop within the function to better match the style of the rest of the code in this file. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260409164328.3999434-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown

ASoC: SDCA: Fix cleanup inversion in class driver

2026-04-09T18:39:30+00:00

Fix inverted cleanup of the SoundWire IRQ and the function drivers that use it. The devm cleanup function to call sdca_dev_unregister_functions() was being registered at the end of class_sdw_probe(). The bus core creates the parent SoundWire IRQ handler after class_sdw_probe() has returned, and it registers a devm cleanup handler at the same time. This led to a cleanup inversion where the devm cleanup for the parent Soundwire IRQ runs before the handler that removes the function drivers. So the parent IRQ is destroyed before the function drivers had a chance to do any cleanup and remove their IRQ handlers. Move the registrations of the function driver cleanup into class_boot_work() after the function drivers are registered, so that it runs before the cleanup of the parent SoundWire IRQ handler. Fixes: 2d877d0659cb ("ASoC: SDCA: Add basic SDCA class driver") Signed-off-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260409164328.3999434-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown

ASoC: SDCA: Correct kernel doc for sdca_irq_cleanup()

2026-04-09T18:39:30+00:00

Fix typo of function argument name in the kernel doc. Fixes: 0b8757b220f9 ("ASoC: SDCA: Unregister IRQ handlers on module remove") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604090800.koxM6j6O-lkp@intel.com/ Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260409164328.3999434-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown

ASoC: SDCA: Unregister IRQ handlers on module remove

2026-04-08T15:55:30+00:00

Ensure that all interrupt handlers are unregistered before the parent regmap_irq is unregistered. sdca_irq_cleanup() was only called from the component_remove(). If the module was loaded and removed without ever being component probed the FDL interrupts would not be unregistered and this would hit a WARN when devm called regmap_del_irq_chip() during the removal of the parent IRQ. Fixes: 4e53116437e9 ("ASoC: SDCA: Fix errors in IRQ cleanup") Signed-off-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260408093835.2881486-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown

ASoC: SDCA: mask Function_Status value

2026-04-08T15:55:29+00:00

According to the SDCA specification [1], when writing Function_Status during handling this control, the value should mask off bit 7. [1] MIPI Specification for SoundWire Device Class for Audio, version 1.1, section 7.14.1.3 (Host Software Handling of Function_Status) Signed-off-by: Maciej Strozek Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260408093835.2881486-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown