From: Peter Ujfalusi peter.ujfalusi@linux.intel.com
[ Upstream commit 2d91cb261cac6d885954b8f5da28b5c176c18131 ]
snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created.
Signed-off-by: Peter Ujfalusi peter.ujfalusi@linux.intel.com Reviewed-by: Bard Liao yung-chuan.liao@linux.intel.com Reviewed-by: Ranjani Sridharan ranjani.sridharan@linux.intel.com Reviewed-by: Liam Girdwood liam.r.girdwood@intel.com Reviewed-by: Kai Vehmanen kai.vehmanen@linux.intel.com Link: https://patch.msgid.link/20250619084222.559-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org ---
LLM Generated explanations, may be completely bogus:
**YES**
This commit should be backported to stable kernel trees. The analysis reveals this is a critical NULL pointer dereference fix that prevents kernel crashes.
**Key reasons for backporting:**
1. **Fixes a Real Crash**: The commit adds a NULL check to prevent a kernel panic that occurs when `snd_soc_remove_pcm_runtime()` is called with `rtd == NULL`. The code change shows this clearly: ```c + if (!rtd) + return; ``` Without this check, the subsequent line `snd_soc_card_remove_dai_link(card, rtd->dai_link)` would dereference NULL.
2. **Minimal and Safe Fix**: The change is extremely small (3 lines) and defensive - it simply adds a NULL check with early return. This follows the stable kernel rule of minimal, contained fixes.
3. **Affects Production Systems**: The commit message indicates this occurs during topology loading when hardware components are missing - a real-world scenario. The issue manifests on module removal when `soc_tplg_remove_link()` calls the function with NULL.
4. **Well-Reviewed**: The commit has 5 Reviewed-by tags from Intel ASoC maintainers, indicating thorough review and consensus on the fix.
5. **No Side Effects**: The fix has no architectural changes or new features - it purely adds defensive programming to prevent crashes. The function already had EXPORT_SYMBOL_GPL, indicating it's part of the kernel API that could be called from various contexts.
This is exactly the type of commit stable trees want: a small, obvious fix for a real crash scenario with no risk of regression.
sound/soc/soc-core.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index 3f97d1f132c6..0db6db16f28b 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -1139,6 +1139,9 @@ static int snd_soc_compensate_channel_connection_map(struct snd_soc_card *card, void snd_soc_remove_pcm_runtime(struct snd_soc_card *card, struct snd_soc_pcm_runtime *rtd) { + if (!rtd) + return; + lockdep_assert_held(&client_mutex);
/*