kernel/linux.git/sound/soc/sof/intel/hda.c, branch v6.12.91

ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.

2025-07-17T16:37:21+00:00

[ Upstream commit 6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e ] sof_pdata->tplg_filename can have address allocated by kstrdup() and can be overwritten. Memory leak was detected with kmemleak: unreferenced object 0xffff88812391ff60 (size 16): comm "kworker/4:1", pid 161, jiffies 4294802931 hex dump (first 16 bytes): 73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00 sof-hda-generic. backtrace (crc 4bf1675c): __kmalloc_node_track_caller_noprof+0x49c/0x6b0 kstrdup+0x46/0xc0 hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic] sof_init_environment+0x16f/0xb50 [snd_sof] sof_probe_continue+0x45/0x7c0 [snd_sof] sof_probe_work+0x1e/0x40 [snd_sof] process_one_work+0x894/0x14b0 worker_thread+0x5e5/0xfb0 kthread+0x39d/0x760 ret_from_fork+0x31/0x70 ret_from_fork_asm+0x1a/0x30 Signed-off-by: Tamura Dai Link: https://patch.msgid.link/20250615235548.8591-1-kirinode0@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin

ASoC: SOF: Intel: hda: Fix UAF when reloading module

2025-05-29T09:03:15+00:00

[ Upstream commit 7dd7f39fce0022b386ef1ea5ffef92ecc7dfc6af ] hda_generic_machine_select() appends -idisp to the tplg filename by allocating a new string with devm_kasprintf(), then stores the string right back into the global variable snd_soc_acpi_intel_hda_machines. When the module is unloaded, this memory is freed, resulting in a global variable pointing to freed memory. Reloading the module then triggers a use-after-free: BUG: KFENCE: use-after-free read in string+0x48/0xe0 Use-after-free read at 0x00000000967e0109 (in kfence-#99): string+0x48/0xe0 vsnprintf+0x329/0x6e0 devm_kvasprintf+0x54/0xb0 devm_kasprintf+0x58/0x80 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic] sof_probe_work+0x7f/0x600 [snd_sof] process_one_work+0x17b/0x330 worker_thread+0x2ce/0x3f0 kthread+0xcf/0x100 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x1a/0x30 kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64 allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago): devm_kmalloc+0x52/0x120 devm_kvasprintf+0x66/0xb0 devm_kasprintf+0x58/0x80 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic] sof_probe_work+0x7f/0x600 [snd_sof] process_one_work+0x17b/0x330 worker_thread+0x2ce/0x3f0 kthread+0xcf/0x100 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x1a/0x30 freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago): release_nodes+0x43/0xb0 devres_release_all+0x90/0xf0 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1c1/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x6d/0xf0 pci_unregister_driver+0x42/0xb0 __do_sys_delete_module+0x1d1/0x310 do_syscall_64+0x82/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fix it by copying the match array with devm_kmemdup_array() before we modify it. Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach") Suggested-by: Peter Ujfalusi Acked-by: Peter Ujfalusi Signed-off-by: Tavian Barnes Link: https://patch.msgid.link/570b15570b274520a0d9052f4e0f064a29c950ef.1747229716.git.tavianator@tavianator.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin

ASoC: SOF: Intel: don't check number of sdw links when set dmic_fixup

2025-03-22T19:54:20+00:00

[ Upstream commit 56a677293509b2a0d39ac8d02b583c1ab1fe4d94 ] Currently, we assume that the PCH DMIC pins are pin-muxed with SoundWire links. However, we do see a HW design that use PCH DMIC along with 3 SoundWire links. Remove the check now. With this change the PCM DMIC will be presented if it is reported by the BIOS irrespective of whether there are SDW links present or not. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Link: https://patch.msgid.link/20250225093716.67240-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin

ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params

2025-02-17T09:04:54+00:00

[ Upstream commit 569922b82ca660f8b24e705f6cf674e6b1f99cc7 ] Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for aggregated amps. And it will cause NULL pointer deference. Check that the DAI widget associated with the CPU DAI is valid to prevent NULL pointer deference due to missing DAI widgets in topologies with aggregated amps. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Liam Girdwood Link: https://patch.msgid.link/20241203104853.56956-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin

ASoC: SOF: Intel: hda: remove common_hdmi_codec_drv

2024-09-12T12:31:49+00:00

Do not set common_hdmi_codec_drv in SOF platform driver since no machine driver needs it. Remove member variable common_hdmi_codec_drv from snd_soc_acpi_mach_params structure. Signed-off-by: Brent Lu Reviewed-by: Péter Ujfalusi Signed-off-by: Bard Liao Link: https://patch.msgid.link/20240912120308.134762-6-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown

ASoC: SOF: Intel: hda: support BT link mask in mach_params

2024-08-28T12:01:57+00:00

Add an new variable bt_link_mask to snd_soc_acpi_mach_params structure. SSP port mask of BT offload found in NHLT table will be sent to machine driver to setup BE dai link with correct SSP port number. This patch only detects and enables the BT dailink. The functionality will only be unlocked with a topology file that makes a reference to that BT dailink. For backwards-compatibility reasons, this topology will not be used by default. Chromebooks and Linux users willing to experiment shall use the tplg_name kernel parameter to force the use of an enhanced topology. Signed-off-by: Brent Lu Reviewed-by: Pierre-Louis Bossart Signed-off-by: Bard Liao Link: https://patch.msgid.link/20240827123215.258859-9-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown

ASoC: SOF: Intel: hda: refactoring topology name fixup for SDW mach

2024-08-28T12:01:54+00:00

Remove SDW mach's topology name fixup code and use the code in hda_machine_select() to fixup its topology file name. No functional change in this commit. Compared with I2S/HDA mach, SDW mach always fixup topology file name with dmic num without using DMIC quirk flag and pass topology name with file extension to SOF driver. Therefore, we add extra code to remove file extension if it exists. Signed-off-by: Brent Lu Reviewed-by: Pierre-Louis Bossart Signed-off-by: Bard Liao Link: https://patch.msgid.link/20240827123215.258859-6-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown

ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach

2024-08-28T12:01:54+00:00

Move I2S mach's topology name fixup code to the end of machine driver enumeration flow so HDA mach could also use same code to fixup its topology file name as well. No functional change in this commit. Signed-off-by: Brent Lu Reviewed-by: Pierre-Louis Bossart Signed-off-by: Bard Liao Link: https://patch.msgid.link/20240827123215.258859-5-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown

ASoC: Intel: Fix RT5650 SSP lookup

2024-07-16T13:07:56+00:00

Commit 8efcd4864652 ("ASoC: Intel: sof_rt5682: use common module for sof_card_private initialization") migrated the pin assignment in the context struct up to soc-acpi-intel-ssp-common.c. This uses a lookup table to see if a device has a amp/codec before assigning the pin. The issue here arises when combination parts that serve both (with 2 ports) are used. sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:1f.3/adl_rt5682_def/SSP0-Codec' CPU: 1 PID: 2079 Comm: udevd Tainted: G U 6.6.36-03391-g744739e00023 #1 3be1a2880a0970f65545a957db7d08ef4b3e2c0d Hardware name: Google Anraggar/Anraggar, BIOS Google_Anraggar.15217.552.0 05/07/2024 Call Trace: dump_stack_lvl+0x69/0xa0 sysfs_warn_dup+0x5b/0x70 sysfs_create_dir_ns+0xb0/0x100 kobject_add_internal+0x133/0x3c0 kobject_add+0x66/0xb0 ? device_add+0x65/0x780 device_add+0x164/0x780 snd_soc_add_pcm_runtimes+0x2fa/0x800 snd_soc_bind_card+0x35e/0xc20 devm_snd_soc_register_card+0x48/0x90 platform_probe+0x7b/0xb0 really_probe+0xf7/0x2a0 ... kobject: kobject_add_internal failed for SSP0-Codec with -EEXIST, don't try to register things with the same name in the same directory. The issue is that the ALC5650 was only defined in the codec table and not the amp table which left the pin unassigned but the dai link was still created by the machine driver. Also patch the suffix filename code for the topology to prevent double suffix names as a result of this change. Fixes: 8efcd4864652 ("ASoC: Intel: sof_rt5682: use common module for sof_card_private initialization") Reviewed-by: Bard Liao Signed-off-by: Curtis Malainey Signed-off-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20240716084012.299257-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown

ASoC: Merge up fixes

2024-06-03T11:45:04+00:00

We need this to get the i.MX platforms working in CI again.