ALSA: aoa: check snd_ctl_new1() return value

snd_ctl_new1() can return NULL when memory allocation fails. In
layout.c, the function does not check the return value before
dereferencing ctl->id.name or passing to aoa_snd_ctl_add(), which can
lead to a NULL pointer dereference.

Add NULL checks after snd_ctl_new1() calls and return early if any
fails.

Assisted-by: Opencode:DeepSeek-V4-Flash
Cc: stable@vger.kernel.org
Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Link: https://patch.msgid.link/tencent_35F3A25FEEBF190A2E15ED787754C57E3708@qq.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/aoa/fabrics/layout.c b/sound/aoa/fabrics/layout.c
index c3ebb6de47891218bb0adcec4e6b3b67d227b507..7bb541577a2636a25096f8b4b7850a413afa8d71 100644 (file)
--- a/sound/aoa/fabrics/layout.c
+++ b/sound/aoa/fabrics/layout.c
@@ -948,6 +948,8 @@ static void layout_attached_codec(struct aoa_codec *codec)
                        if (lineout == 1)
                                ldev->gpio.methods->set_lineout(codec->gpio, 1);
                        ctl = snd_ctl_new1(&lineout_ctl, codec->gpio);
+                       if (!ctl)
+                               return;
                        if (cc->connected & CC_LINEOUT_LABELLED_HEADPHONE)
                                strscpy(ctl->id.name, "Headphone Switch");
                        ldev->lineout_ctrl = ctl;
@@ -961,12 +963,16 @@ static void layout_attached_codec(struct aoa_codec *codec)
                        if (ldev->have_lineout_detect) {
                                ctl = snd_ctl_new1(&lineout_detect_choice,
                                                   ldev);
+                               if (!ctl)
+                                       return;
                                if (cc->connected & CC_LINEOUT_LABELLED_HEADPHONE)
                                        strscpy(ctl->id.name,
                                                "Headphone Detect Autoswitch");
                                aoa_snd_ctl_add(ctl);
                                ctl = snd_ctl_new1(&lineout_detected,
                                                   ldev);
+                               if (!ctl)
+                                       return;
                                if (cc->connected & CC_LINEOUT_LABELLED_HEADPHONE)
                                        strscpy(ctl->id.name,
                                                "Headphone Detected");