[bug report] ASoC: SOF: sof-audio: Add support for loopback capture

[Dan Carpenter]

[ Smatch checking is paused while we raise funding. #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Ranjani Sridharan,

Commit c4b37c21c75d ("ASoC: SOF: sof-audio: Add support for loopback
capture") from Feb 4, 2026 (linux-next), leads to the following
Smatch static checker warning:

	sound/soc/sof/sof-audio.c:534 sof_prepare_widgets_in_path()
	error: uninitialized symbol 'widget_ops'.

sound/soc/sof/sof-audio.c
    478 static int
    479 sof_prepare_widgets_in_path(struct snd_sof_dev *sdev, struct snd_soc_dapm_widget *widget,
    480                             struct snd_pcm_hw_params *fe_params,
    481                             struct snd_sof_platform_stream_params *platform_params,
    482                             struct snd_pcm_hw_params *pipeline_params, int dir,
    483                             struct snd_soc_dapm_widget_list *list)
    484 {
    485         const struct sof_ipc_tplg_ops *tplg_ops = sof_ipc_get_ops(sdev, tplg);
    486         struct snd_sof_widget *swidget = widget->dobj.private;
    487         const struct sof_ipc_tplg_widget_ops *widget_ops;
    488         struct snd_soc_dapm_path *p;
    489         int ret;
    490 
    491         if (is_virtual_widget(sdev, widget, __func__))
    492                 return 0;
    493 
    494         if (!swidget)
    495                 goto sink_prepare;
                        ^^^^^^^^^^^^^^^^^
widget_ops is uninitialized.

    496 
    497         widget_ops = tplg_ops ? tplg_ops->widget : NULL;
    498         if (!widget_ops)
    499                 return 0;
    500 
    501         if (swidget->spipe && swidget->spipe->direction_valid &&
    502             !sof_widget_in_same_direction(swidget, dir))
    503                 return 0;
    504 
    505         /* skip widgets already prepared or aggregated DAI widgets*/
    506         if (!widget_ops[widget->id].ipc_prepare || swidget->prepared ||
    507             is_aggregated_dai(swidget))
    508                 goto sink_prepare;
    509 
    510         /* prepare the source widget */
    511         ret = widget_ops[widget->id].ipc_prepare(swidget, fe_params, platform_params,
    512                                              pipeline_params, dir);
    513         if (ret < 0) {
    514                 dev_err(sdev->dev, "failed to prepare widget %s\n", widget->name);
    515                 return ret;
    516         }
    517 
    518         swidget->prepared = true;
    519 
    520 sink_prepare:
    521         /* prepare all widgets in the sink paths */
    522         snd_soc_dapm_widget_for_each_sink_path(widget, p) {
    523                 if (!widget_in_list(list, p->sink))
    524                         continue;
    525 
    526                 if (!p->walking && p->sink->dobj.private) {
    527                         p->walking = true;
    528                         ret = sof_prepare_widgets_in_path(sdev, p->sink,  fe_params,
    529                                                           platform_params, pipeline_params, dir,
    530                                                           list);
    531                         p->walking = false;
    532                         if (ret < 0) {
    533                                 /* unprepare the source widget */
--> 534                                 if (widget_ops[widget->id].ipc_unprepare &&
    535                                     swidget && swidget->prepared && swidget->use_count == 0) {

We need to check that swidget is non-NULL first before checking
widget_ops[widget->id].ipc_unprepare, otherwise widget_ops is
uninitialized and it leads to a crash.

Wait, the zero day bot already reported this on Jan 5th.
https://lore.kernel.org/all/202512232221.Ub3HwrFz-lkp@xxxxxxxxx/

    536                                         widget_ops[widget->id].ipc_unprepare(swidget);
    537                                         swidget->prepared = false;
    538                                 }
    539                                 return ret;
    540                         }
    541                 }
    542         }
    543 
    544         return 0;
    545 }

regards,
dan carpenter