[PATCH] ASoC: Intel: bytcr_rt5640: Fix use-after-free in snd_byt_rt5640_mc_probe()

[PATCH] ASoC: Intel: bytcr_rt5640: Fix use-after-free in snd_byt_rt5640_mc_probe()

[Wentao Liang]

When the device found by name is not an i2c_client, the reference taken
by bus_find_device_by_name() is dropped, but execution continues with
the stale codec_dev pointer, which is stored in priv->codec_dev and
dereferenced later in the probe.

The device is not usable as the codec, so return an error after dropping
the reference.

Fixes: d48696b91552 ("ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 sound/soc/intel/boards/bytcr_rt5640.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index 40da3eea5fa7..557486c6f28d 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -1764,6 +1764,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
 			dev_err(dev, "Error '%s' is not an i2c_client\n",
 				BYT_RT5640_FALLBACK_CODEC_DEV_NAME);
 			put_device(codec_dev);
+			return -ENODEV;
 		}
 
 		/* fixup codec name */
-- 
2.34.1

Re: [PATCH] ASoC: Intel: bytcr_rt5640: Fix use-after-free in snd_byt_rt5640_mc_probe()

[Cezary Rojewski]

On 9/17/2026 7:00 PM, Wentao Liang wrote:
> When the device found by name is not an i2c_client, the reference taken
> by bus_find_device_by_name() is dropped, but execution continues with
> the stale codec_dev pointer, which is stored in priv->codec_dev and
> dereferenced later in the probe.
> 
> The device is not usable as the codec, so return an error after dropping
> the reference.
> 
> Fixes: d48696b91552 ("ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  sound/soc/intel/boards/bytcr_rt5640.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
> index 40da3eea5fa7..557486c6f28d 100644
> --- a/sound/soc/intel/boards/bytcr_rt5640.c
> +++ b/sound/soc/intel/boards/bytcr_rt5640.c
> @@ -1764,6 +1764,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
>  			dev_err(dev, "Error '%s' is not an i2c_client\n",
>  				BYT_RT5640_FALLBACK_CODEC_DEV_NAME);
>  			put_device(codec_dev);
> +			return -ENODEV;

I haven't found any 'return -ENODEV' after a failing i2c_verify_client()
check.  Most ignore, one (drivers/hwmon/hwmon.c) ends with -EINVAL.

Given the description of i2c_verify_client() I'd argue -EINVAL is a
better candidate.

A sidetopic, not strongly related to the error code - after analyzing
snd_byt_rt5640_mc_probe() its seems the check could be skipped entirely
if the portion of the function - dependent on codec_dev - is moved to
ASoC e.g.: card->late_probe().


Kind regards,
Czarek