mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00

Regulator support was introduced in commitd3321a20b5
("ASoC: dmic: add regulator support"). During probe `dmic->vref` is initialized with devm_regulator_get_optional() but in the error flow doesn't get cleared in the case that PTR_ERR(dmic->vref) is -ENODEV. This leads to the following NULL pointer deref. ``` Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 1000 PID: 1587 Comm: wireplumber Not tainted 6.14.0-rc7-next-20250318 #1 PREEMPT(voluntary) RIP: 0010:regulator_enable+0x17/0x70 RSP: 0018:ffffcc10c1fe7a38 EFLAGS: 00010282 RAX: ffff8bccc1c25010 RBX: ffffffffffffffed RCX: 0000000000000000 RDX: 0000000000000002 RSI: ffffcc10c1fe7a38 RDI: ffffffffffffffed RBP: ffffcc10c1fe7a68 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8bcccd51f800 R13: ffffffffc1086e88 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f927bc35800(0000) GS:ffff8bd44f09f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000065 CR3: 00000001332c6000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? show_regs+0x6c/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x154/0x570 ? hrtimer_start_range_ns+0x142/0x4e0 ? timerqueue_del+0x31/0x50 ? do_user_addr_fault+0x4ac/0x880 ? exc_page_fault+0x82/0x1d0 ? asm_exc_page_fault+0x27/0x30 ? regulator_enable+0x17/0x70 ? __schedule+0x491/0x16b0 dmic_aif_event+0x82/0xa0 [snd_soc_dmic] ``` Adjust the error flow to explicitly set it back to NULL to avoid calling regulator_enable() with garbage data. Reported-by: Akshata V Unkal <Akshata.VUnkal@amd.com> Fixes:d3321a20b5
("ASoC: dmic: add regulator support") Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://patch.msgid.link/20250319145636.2401680-1-superm1@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
216 lines
5.1 KiB
C
216 lines
5.1 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* dmic.c -- SoC audio for Generic Digital MICs
|
|
*
|
|
* Author: Liam Girdwood <lrg@slimlogic.co.uk>
|
|
*/
|
|
|
|
#include <linux/delay.h>
|
|
#include <linux/gpio.h>
|
|
#include <linux/gpio/consumer.h>
|
|
#include <linux/platform_device.h>
|
|
#include <linux/regulator/consumer.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/module.h>
|
|
#include <sound/core.h>
|
|
#include <sound/pcm.h>
|
|
#include <sound/soc.h>
|
|
#include <sound/soc-dapm.h>
|
|
|
|
#define MAX_MODESWITCH_DELAY 70
|
|
static int modeswitch_delay;
|
|
module_param(modeswitch_delay, uint, 0644);
|
|
|
|
static int wakeup_delay;
|
|
module_param(wakeup_delay, uint, 0644);
|
|
|
|
struct dmic {
|
|
struct gpio_desc *gpio_en;
|
|
struct regulator *vref;
|
|
int wakeup_delay;
|
|
/* Delay after DMIC mode switch */
|
|
int modeswitch_delay;
|
|
};
|
|
|
|
static int dmic_daiops_trigger(struct snd_pcm_substream *substream,
|
|
int cmd, struct snd_soc_dai *dai)
|
|
{
|
|
struct snd_soc_component *component = dai->component;
|
|
struct dmic *dmic = snd_soc_component_get_drvdata(component);
|
|
|
|
switch (cmd) {
|
|
case SNDRV_PCM_TRIGGER_STOP:
|
|
if (dmic->modeswitch_delay)
|
|
mdelay(dmic->modeswitch_delay);
|
|
|
|
break;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct snd_soc_dai_ops dmic_dai_ops = {
|
|
.trigger = dmic_daiops_trigger,
|
|
};
|
|
|
|
static int dmic_aif_event(struct snd_soc_dapm_widget *w,
|
|
struct snd_kcontrol *kcontrol, int event) {
|
|
struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
|
|
struct dmic *dmic = snd_soc_component_get_drvdata(component);
|
|
int ret = 0;
|
|
|
|
switch (event) {
|
|
case SND_SOC_DAPM_POST_PMU:
|
|
if (dmic->gpio_en)
|
|
gpiod_set_value_cansleep(dmic->gpio_en, 1);
|
|
|
|
if (dmic->vref) {
|
|
ret = regulator_enable(dmic->vref);
|
|
if (ret)
|
|
return ret;
|
|
}
|
|
|
|
if (dmic->wakeup_delay)
|
|
msleep(dmic->wakeup_delay);
|
|
break;
|
|
case SND_SOC_DAPM_POST_PMD:
|
|
if (dmic->gpio_en)
|
|
gpiod_set_value_cansleep(dmic->gpio_en, 0);
|
|
|
|
if (dmic->vref)
|
|
ret = regulator_disable(dmic->vref);
|
|
|
|
break;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static struct snd_soc_dai_driver dmic_dai = {
|
|
.name = "dmic-hifi",
|
|
.capture = {
|
|
.stream_name = "Capture",
|
|
.channels_min = 1,
|
|
.channels_max = 8,
|
|
.rates = SNDRV_PCM_RATE_CONTINUOUS,
|
|
.formats = SNDRV_PCM_FMTBIT_S32_LE
|
|
| SNDRV_PCM_FMTBIT_S24_LE
|
|
| SNDRV_PCM_FMTBIT_S16_LE
|
|
| SNDRV_PCM_FMTBIT_DSD_U8
|
|
| SNDRV_PCM_FMTBIT_DSD_U16_LE
|
|
| SNDRV_PCM_FMTBIT_DSD_U32_LE
|
|
| SNDRV_PCM_FMTBIT_DSD_U16_BE
|
|
| SNDRV_PCM_FMTBIT_DSD_U32_BE,
|
|
},
|
|
.ops = &dmic_dai_ops,
|
|
};
|
|
|
|
static int dmic_component_probe(struct snd_soc_component *component)
|
|
{
|
|
struct dmic *dmic;
|
|
|
|
dmic = devm_kzalloc(component->dev, sizeof(*dmic), GFP_KERNEL);
|
|
if (!dmic)
|
|
return -ENOMEM;
|
|
|
|
dmic->vref = devm_regulator_get_optional(component->dev, "vref");
|
|
if (IS_ERR(dmic->vref)) {
|
|
if (PTR_ERR(dmic->vref) != -ENODEV)
|
|
return dev_err_probe(component->dev, PTR_ERR(dmic->vref),
|
|
"Failed to get vref\n");
|
|
dmic->vref = NULL;
|
|
}
|
|
|
|
dmic->gpio_en = devm_gpiod_get_optional(component->dev,
|
|
"dmicen", GPIOD_OUT_LOW);
|
|
if (IS_ERR(dmic->gpio_en))
|
|
return PTR_ERR(dmic->gpio_en);
|
|
|
|
device_property_read_u32(component->dev, "wakeup-delay-ms",
|
|
&dmic->wakeup_delay);
|
|
device_property_read_u32(component->dev, "modeswitch-delay-ms",
|
|
&dmic->modeswitch_delay);
|
|
if (wakeup_delay)
|
|
dmic->wakeup_delay = wakeup_delay;
|
|
if (modeswitch_delay)
|
|
dmic->modeswitch_delay = modeswitch_delay;
|
|
|
|
if (dmic->modeswitch_delay > MAX_MODESWITCH_DELAY)
|
|
dmic->modeswitch_delay = MAX_MODESWITCH_DELAY;
|
|
|
|
snd_soc_component_set_drvdata(component, dmic);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct snd_soc_dapm_widget dmic_dapm_widgets[] = {
|
|
SND_SOC_DAPM_AIF_OUT_E("DMIC AIF", "Capture", 0,
|
|
SND_SOC_NOPM, 0, 0, dmic_aif_event,
|
|
SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
|
|
SND_SOC_DAPM_INPUT("DMic"),
|
|
};
|
|
|
|
static const struct snd_soc_dapm_route intercon[] = {
|
|
{"DMIC AIF", NULL, "DMic"},
|
|
};
|
|
|
|
static const struct snd_soc_component_driver soc_dmic = {
|
|
.probe = dmic_component_probe,
|
|
.dapm_widgets = dmic_dapm_widgets,
|
|
.num_dapm_widgets = ARRAY_SIZE(dmic_dapm_widgets),
|
|
.dapm_routes = intercon,
|
|
.num_dapm_routes = ARRAY_SIZE(intercon),
|
|
.idle_bias_on = 1,
|
|
.use_pmdown_time = 1,
|
|
.endianness = 1,
|
|
};
|
|
|
|
static int dmic_dev_probe(struct platform_device *pdev)
|
|
{
|
|
int err;
|
|
u32 chans;
|
|
struct snd_soc_dai_driver *dai_drv = &dmic_dai;
|
|
|
|
if (pdev->dev.of_node) {
|
|
err = of_property_read_u32(pdev->dev.of_node, "num-channels", &chans);
|
|
if (err && (err != -EINVAL))
|
|
return err;
|
|
|
|
if (!err) {
|
|
if (chans < 1 || chans > 8)
|
|
return -EINVAL;
|
|
|
|
dai_drv = devm_kzalloc(&pdev->dev, sizeof(*dai_drv), GFP_KERNEL);
|
|
if (!dai_drv)
|
|
return -ENOMEM;
|
|
|
|
memcpy(dai_drv, &dmic_dai, sizeof(*dai_drv));
|
|
dai_drv->capture.channels_max = chans;
|
|
}
|
|
}
|
|
|
|
return devm_snd_soc_register_component(&pdev->dev,
|
|
&soc_dmic, dai_drv, 1);
|
|
}
|
|
|
|
MODULE_ALIAS("platform:dmic-codec");
|
|
|
|
static const struct of_device_id dmic_dev_match[] = {
|
|
{.compatible = "dmic-codec"},
|
|
{}
|
|
};
|
|
MODULE_DEVICE_TABLE(of, dmic_dev_match);
|
|
|
|
static struct platform_driver dmic_driver = {
|
|
.driver = {
|
|
.name = "dmic-codec",
|
|
.of_match_table = dmic_dev_match,
|
|
},
|
|
.probe = dmic_dev_probe,
|
|
};
|
|
|
|
module_platform_driver(dmic_driver);
|
|
|
|
MODULE_DESCRIPTION("Generic DMIC driver");
|
|
MODULE_AUTHOR("Liam Girdwood <lrg@slimlogic.co.uk>");
|
|
MODULE_LICENSE("GPL");
|