Patch "ALSA: asihpi: check pao in control_message()" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ALSA: asihpi: check pao in control_message()

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     alsa-asihpi-check-pao-in-control_message.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2e99f1279e29cb442623e6dde00422a8da4b6850
Author: Kuninori Morimoto <kuninori.morimoto.gx@xxxxxxxxxxx>
Date:   Mon Mar 13 00:49:24 2023 +0000

    ALSA: asihpi: check pao in control_message()
    
    [ Upstream commit 9026c0bf233db53b86f74f4c620715e94eb32a09 ]
    
    control_message() might be called with pao = NULL.
    Here indicates control_message() as sample.
    
    (B)     static void control_message(struct hpi_adapter_obj *pao, ...)
            {                                                   ^^^
                    struct hpi_hw_obj *phw = pao->priv;
                    ...                      ^^^
            }
    
    (A)     void _HPI_6205(struct hpi_adapter_obj *pao, ...)
            {                                      ^^^
                    ...
                    case HPI_OBJ_CONTROL:
    (B)                     control_message(pao, phm, phr);
                            break;          ^^^
                    ...
            }
    
            void HPI_6205(...)
            {
                    ...
    (A)             _HPI_6205(NULL, phm, phr);
                    ...       ^^^^
            }
    
    Therefore, We will get too many warning via cppcheck, like below
    
            sound/pci/asihpi/hpi6205.c:238:27: warning: Possible null pointer dereference: pao [nullPointer]
                     struct hpi_hw_obj *phw = pao->priv;
                                              ^
            sound/pci/asihpi/hpi6205.c:433:13: note: Calling function '_HPI_6205', 1st argument 'NULL' value is 0
                      _HPI_6205(NULL, phm, phr);
                                ^
            sound/pci/asihpi/hpi6205.c:401:20: note: Calling function 'control_message', 1st argument 'pao' value is 0
               control_message(pao, phm, phr);
                               ^
    Set phr->error like many functions doing, and don't call _HPI_6205()
    with NULL.
    
    Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@xxxxxxxxxxx>
    Link: https://lore.kernel.org/r/87ttypeaqz.wl-kuninori.morimoto.gx@xxxxxxxxxxx
    Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/sound/pci/asihpi/hpi6205.c b/sound/pci/asihpi/hpi6205.c
index 27e11b5f70b97..c7d7eff86727f 100644
--- a/sound/pci/asihpi/hpi6205.c
+++ b/sound/pci/asihpi/hpi6205.c
@@ -430,7 +430,7 @@ void HPI_6205(struct hpi_message *phm, struct hpi_response *phr)
 		pao = hpi_find_adapter(phm->adapter_index);
 	} else {
 		/* subsys messages don't address an adapter */
-		_HPI_6205(NULL, phm, phr);
+		phr->error = HPI_ERROR_INVALID_OBJ_INDEX;
 		return;
 	}