ASoC: cs42l42: Prevent NULL pointer deref in interrupt handler

The interrupt handling code was getting the struct device* from a
struct snd_soc_component* stored in struct cs42l42_private. If the
interrupt was asserted before ASoC calls component_probe() the
snd_soc_component* will be NULL.

The stored snd_soc_component* is not actually used for anything other
than indirectly getting the struct device*. Remove it, and store the
struct device* in struct cs42l42_private.

Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20211025112258.9282-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
index 0dbe4e23194b20d381d4e01177d4e5044ce60b6c..a8fff274ec633736f7f1857c575f36724b4bb47e 100644 (file)
--- a/sound/soc/codecs/cs42l42.c
+++ b/sound/soc/codecs/cs42l42.c
@@ -526,17 +526,7 @@ static int cs42l42_set_jack(struct snd_soc_component *component, struct snd_soc_
        return 0;
 }
 
-static int cs42l42_component_probe(struct snd_soc_component *component)
-{
-       struct cs42l42_private *cs42l42 = snd_soc_component_get_drvdata(component);
-
-       cs42l42->component = component;
-
-       return 0;
-}
-
 static const struct snd_soc_component_driver soc_component_dev_cs42l42 = {
-       .probe                  = cs42l42_component_probe,
        .set_jack               = cs42l42_set_jack,
        .dapm_widgets           = cs42l42_dapm_widgets,
        .num_dapm_widgets       = ARRAY_SIZE(cs42l42_dapm_widgets),
@@ -1207,7 +1197,7 @@ static void cs42l42_process_hs_type_detect(struct cs42l42_private *cs42l42)
         */
        if (cs42l42->hs_type == CS42L42_PLUG_INVALID ||
                cs42l42->hs_type == CS42L42_PLUG_HEADPHONE) {
-               dev_dbg(cs42l42->component->dev, "Running Manual Detection Fallback\n");
+               dev_dbg(cs42l42->dev, "Running Manual Detection Fallback\n");
                cs42l42_manual_hs_type_detect(cs42l42);
        }
 
@@ -1506,19 +1496,19 @@ static int cs42l42_handle_button_press(struct cs42l42_private *cs42l42)
        switch (bias_level) {
        case 1: /* Function C button press */
                bias_level = SND_JACK_BTN_2;
-               dev_dbg(cs42l42->component->dev, "Function C button press\n");
+               dev_dbg(cs42l42->dev, "Function C button press\n");
                break;
        case 2: /* Function B button press */
                bias_level = SND_JACK_BTN_1;
-               dev_dbg(cs42l42->component->dev, "Function B button press\n");
+               dev_dbg(cs42l42->dev, "Function B button press\n");
                break;
        case 3: /* Function D button press */
                bias_level = SND_JACK_BTN_3;
-               dev_dbg(cs42l42->component->dev, "Function D button press\n");
+               dev_dbg(cs42l42->dev, "Function D button press\n");
                break;
        case 4: /* Function A button press */
                bias_level = SND_JACK_BTN_0;
-               dev_dbg(cs42l42->component->dev, "Function A button press\n");
+               dev_dbg(cs42l42->dev, "Function A button press\n");
                break;
        default:
                bias_level = 0;
@@ -1592,7 +1582,6 @@ static const struct cs42l42_irq_params irq_params_table[] = {
 static irqreturn_t cs42l42_irq_thread(int irq, void *data)
 {
        struct cs42l42_private *cs42l42 = (struct cs42l42_private *)data;
-       struct snd_soc_component *component = cs42l42->component;
        unsigned int stickies[12];
        unsigned int masks[12];
        unsigned int current_plug_status;
@@ -1639,7 +1628,7 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data)
                        default:
                                break;
                        }
-                       dev_dbg(component->dev, "Auto detect done (%d)\n", cs42l42->hs_type);
+                       dev_dbg(cs42l42->dev, "Auto detect done (%d)\n", cs42l42->hs_type);
                }
        }
 
@@ -1673,7 +1662,7 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data)
                                                    SND_JACK_BTN_0 | SND_JACK_BTN_1 |
                                                    SND_JACK_BTN_2 | SND_JACK_BTN_3);
 
-                               dev_dbg(component->dev, "Unplug event\n");
+                               dev_dbg(cs42l42->dev, "Unplug event\n");
                        }
                        break;
 
@@ -1689,7 +1678,7 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data)
                        CS42L42_M_HSBIAS_HIZ_MASK)) {
 
                        if (current_button_status & CS42L42_M_DETECT_TF_MASK) {
-                               dev_dbg(component->dev, "Button released\n");
+                               dev_dbg(cs42l42->dev, "Button released\n");
                                report = 0;
                        } else if (current_button_status & CS42L42_M_DETECT_FT_MASK) {
                                report = cs42l42_handle_button_press(cs42l42);
@@ -2043,6 +2032,7 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,
        if (!cs42l42)
                return -ENOMEM;
 
+       cs42l42->dev = &i2c_client->dev;
        i2c_set_clientdata(i2c_client, cs42l42);
 
        cs42l42->regmap = devm_regmap_init_i2c(i2c_client, &cs42l42_regmap);

diff --git a/sound/soc/codecs/cs42l42.h b/sound/soc/codecs/cs42l42.h
index dd4744de9e0a6f7396e530acd69d2e3a0414a062..f45bcc9a3a62fe5edd4cbb236f0fa17e8dfdbe70 100644 (file)
--- a/sound/soc/codecs/cs42l42.h
+++ b/sound/soc/codecs/cs42l42.h
@@ -833,7 +833,7 @@ static const char *const cs42l42_supply_names[CS42L42_NUM_SUPPLIES] = {
 
 struct  cs42l42_private {
        struct regmap *regmap;
-       struct snd_soc_component *component;
+       struct device *dev;
        struct regulator_bulk_data supplies[CS42L42_NUM_SUPPLIES];
        struct gpio_desc *reset_gpio;
        struct completion pdn_done;