CVE-2024-50104 in Linux
Сводка
по VulDB • 29.05.2026
Based on the crash trace and assembly analysis provided, here is a detailed breakdown of the issue, root cause, and recommended fix.
### 1. Summary of the Issue - **Crash Location**: `sdw_stream_add_slave()` in the SoundWire bus driver. - **Faulting Instruction**: `ldr x2, [x25, #32]!` (Offset `0x44` from function start).
- **Root Cause**: A **NULL pointer dereference**. The register `x25` holds a NULL pointer because it was copied from `x4`, which was passed as `NULL` from `wsa881x_hw_params()`. - **Trigger**: The WSA881x codec driver is calling `sdw_stream_add_slave()` with a `NULL` stream pointer.
---
### 2. Detailed Analysis
#### A. Register State at Crash From the assembly dump: ```assembly 6134: aa0403f9 mov x25, x4 <-- x4 copied to x25 ... 614c: f8420f22 ldr x2, [x25, #32]! <-- Data Abort here
``` - `x25` is used as a base pointer for accessing the `sdw_stream` structure. - `x25` was loaded from `x4`. - In the ARM64 AAPCS calling convention, `x0`–`x7` are argument registers. - `x0`: `struct sdw_bus *bus` - `x1`: `struct sdw_slave *slave` - `x2`: `struct sdw_stream *stream` (This is the 3rd argument, but note the function signature) - `x3`: `struct snd_pcm_hw_params *params` - `x4`: **This is the 5th argument.**
Wait, let's verify the function signature of `sdw_stream_add_slave`: ```c int sdw_stream_add_slave(struct sdw_bus *bus, struct sdw_slave *slave, struct sdw_stream *stream, struct snd_pcm_hw_params *params, struct snd_soc_dai *dai); ``` Actually, looking at the kernel source (e.g., `sound/soc/sdw/sdw_stream.c`), the signature is: ```c int sdw_stream_add_slave(struct sdw_bus *bus, struct sdw_slave *slave, struct sdw_stream *stream, struct snd_pcm_hw_params *params, struct snd_soc_dai *dai); ``` Arguments: - `x0`: `bus` - `x1`: `slave` - `x2`: `stream` - `x3`: `params` - `x4`: `dai`
**Contradiction?** The user says `wsa881x_hw_params()` passes `stream = NULL` in `x4`. But `stream` is the 3rd argument (`x2`). Let's re-examine the assembly.
The assembly shows: ```assembly 6120: 2a0303f5 mov w21, w3 6124: a90363f7 stp x23, x24, [sp, #48]
6128: aa0003f8 mov x24, x0 612c: aa0203f7 mov x23, x2 6130: a9046bf9 stp x25, x26, [sp, #64]
6134: aa0403f9 mov x25, x4 <-- x4 copied to x25 ``` The code saves `x4` into `x25`. Then later: ```assembly 614c: f8420f22 ldr x2, [x25, #32]!
``` It dereferences `x25` (which is `x4`). This means the code expects `x4` to be a valid pointer to a structure.
If `sdw_stream_add_slave` expects `stream` as the 3rd argument (`x2`), why is it dereferencing `x4`?
Let's look at the actual implementation of `sdw_stream_add_slave` in recent kernels (e.g., Linux 5.10+): ```c int sdw_stream_add_slave(struct sdw_bus *bus, struct sdw_slave *slave, struct sdw_stream *stream,
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.