ALSA: hda/realtek - Allow NULL bus->pci

[Dan Carpenter]

Hello Takashi Iwai,

The patch 5100cd07d43a: "ALSA: hda/realtek - Allow NULL bus->pci"
from Feb 15, 2014, leads to the following static checker warning:

sound/pci/hda/patch_realtek.c:5371 patch_alc269()
warn: variable dereferenced before check 'codec->bus->pci' (see line 5364)

sound/pci/hda/patch_realtek.c
5363 if (has_cdefine_beep(codec))
^^^^^
We actually dereference "codec->bus->pci" inside the call to
has_cdefine_beep().

5364 spec->gen.beep_nid = 0x01;
5365
5366 switch (codec->vendor_id) {
5367 case 0x10ec0269:
5368 spec->codec_variant = ALC269_TYPE_ALC269VA;
5369 switch (alc_get_coef0(codec) & 0x00f0) {
5370 case 0x0010:
5371 if (codec->bus->pci &&
^^^^^^^^^^^^^^^
This new check is too late.

5372 codec->bus->pci->subsystem_vendor == 0x1025 &&
5373 spec->cdefine.platform_type == 1)
5374 err = alc_codec_rename(codec, "ALC271X");
5375 spec->codec_variant = ALC269_TYPE_ALC269VB;
5376 break;

There is another related warning:

sound/pci/hda/patch_realtek.c:6270 patch_alc662() warn: variable dereferenced before check 'codec->bus->pci' (see line 6267)

regards,
dan carpenter

[Takashi Iwai]

At Wed, 8 Oct 2014 12:32:46 +0300,

Post by Dan Carpenter
Hello Takashi Iwai,
The patch 5100cd07d43a: "ALSA: hda/realtek - Allow NULL bus->pci"
sound/pci/hda/patch_realtek.c:5371 patch_alc269()
warn: variable dereferenced before check 'codec->bus->pci' (see line 5364)
sound/pci/hda/patch_realtek.c
5363 if (has_cdefine_beep(codec))
^^^^^
We actually dereference "codec->bus->pci" inside the call to
has_cdefine_beep().

Indeed. I fixed snd_pci_quirk_lookup() itself to accept NULL pointer
as a generic fix in below.


Thanks!

Takashi

-- 8< --
From: Takashi Iwai <***@suse.de>
Subject: [PATCH] ALSA: Allow pass NULL dev for snd_pci_quirk_lookup()

Add a NULL check in snd_pci_quirk_lookup() so that NULL can be passed
as a pci_dev pointer. This fixes the possible NULL dereferences in
HD-audio drivers.

Reported-by: Dan Carpenter <***@oracle.com>
Signed-off-by: Takashi Iwai <***@suse.de>
---
sound/core/misc.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/sound/core/misc.c b/sound/core/misc.c
index 30e027ecf4da..f2e8226c88fb 100644
--- a/sound/core/misc.c
+++ b/sound/core/misc.c
@@ -145,6 +145,8 @@ EXPORT_SYMBOL(snd_pci_quirk_lookup_id);
const struct snd_pci_quirk *
snd_pci_quirk_lookup(struct pci_dev *pci, const struct snd_pci_quirk *list)
{
+ if (!pci)
+ return NULL;
return snd_pci_quirk_lookup_id(pci->subsystem_vendor,
pci->subsystem_device,
list);