ALSA: usb: qcom: fix NULL pointer dereference in qmi_stop_session

The find_substream() call may return NULL, but the error path
dereferenced 'subs' unconditionally via dev_err(&subs->dev->dev, ...),
causing a NULL pointer dereference when subs is NULL.

Fix by switching to &uadev[idx].udev->dev which is always valid
in this context.

Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Link: https://patch.msgid.link/86ac2939273ac853535049e60391c09d7688714e.1750755508.git.xiaopei01@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/usb/qcom/qc_audio_offload.c b/sound/usb/qcom/qc_audio_offload.c
index 797afd4561bd0c1541fa4cd1cb4ace1812863a00..3543b5a535927a6cfd8b54d03bb057910c468b64 100644 (file)
--- a/sound/usb/qcom/qc_audio_offload.c
+++ b/sound/usb/qcom/qc_audio_offload.c
@@ -759,7 +759,7 @@ static void qmi_stop_session(void)
                        subs = find_substream(pcm_card_num, info->pcm_dev_num,
                                              info->direction);
                        if (!subs || !chip || atomic_read(&chip->shutdown)) {
-                               dev_err(&subs->dev->dev,
+                               dev_err(&uadev[idx].udev->dev,
                                        "no sub for c#%u dev#%u dir%u\n",
                                        info->pcm_card_num,
                                        info->pcm_dev_num,