[REGRESSION] NULL pointer dereference in rt1011_recv_spk_mode_put on Tiger Lake (kernel 6.19.6)

[Fisiu]

Summary

Kernel 6.19 triggers a NULL pointer dereference in the rt1011 codec driver (rt1011_recv_spk_mode_put) during standard boot seqence.
This occurs on Tiger Lake hardware using SOF with rt5682 codec + dual rt1011 smart amplifiers.
The crash renders audio unusable since no audio device is available.

Hardware

• Platform: Google Lillipup / Lindar board
• CPU: 11th Gen Intel Core i3-1115G4 @ 3.00 GHz (Tiger Lake)
• Firmware: MrChromebox-2512.2 dated 01/25/2026
• Audio controller: Intel Tiger Lake-LP Smart Sound Technology [8086:a0c8] (rev 20)
  • Kernel driver in use: sof-audio-pci-intel-tgl
• Amplifiers: Realtek rt5682 (codec) + dual rt1011 (smart amplifiers)

Software

• Distribution: CachyOS (Arch-based)
• Kernel: 6.19.6-2-cachyos
• SOF firmware: 2025.12.2-1 (from Arch extra repository)
• Kernel config relevant line:
  CONFIG_SND_SOC_RT1011=m

Reproduction Steps

1. Boot the system with default kernel parameters.
2. Log in to a standard Plasma (KDE) desktop session.
3. Wait for the desktop environment to fully initialize.
   → Kernel oops appears in dmesg without any manual audio-related commands.
   → Audio devices become unavailable (aplay -l and arecord -l show no soundcards; pactl list cards is empty).

$ pacman -Qi sof-firmware
Installed From  : extra
Name            : sof-firmware
Version         : 2025.12.2-1
Description     : Sound Open Firmware
Architecture    : x86_64
URL             : https://www.sofproject.org/
Licenses        : BSD-3-Clause AND ISC
Groups          : None
Provides        : None
Depends On      : None
Optional Deps   : None
Required By     : None
Optional For    : None
Conflicts With  : None
Replaces        : None
Installed Size  : 42,80 MiB
Packager        : Jan Alexander Steffens (heftig) <heftig@archlinux.org>
Build Date      : czw, 29 sty 2026, 06:43:49
Install Date    : pią, 30 sty 2026, 13:58:30
Install Reason  : Explicitly installed
Install Script  : No
Validated By    : Signature

$ aplay -l
aplay: device_list:279: no soundcards found...

$ arecord -l
arecord: device_list:279: no soundcards found...

$ pactl list cards

$ lspci -knn | grep -A3 Audio
00:1f.3 Multimedia audio controller [0401]: Intel Corporation Tiger Lake-LP Smart Sound Technology Audio Controller [8086:a0c8] (rev 20)
DeviceName: Multimedia audio controller
Kernel driver in use: sof-audio-pci-intel-tgl
Kernel modules: snd_soc_avs, snd_sof_pci_intel_tgl, snd_hda_intel

$ zgrep SND_SOC_RT1011 /proc/config.gz
CONFIG_SND_SOC_RT1011=m

dmesg-6.19.6-2-cachyos-audio.txt

The LTS kernel (linux-cachyos-lts-6.18.16-2) functions as expected with no audio-related kernel oops or device loss during boot or Plasma session initialization.

[ujfalusi]

@Fisiu, the only thing that differs between 6.18.16 and 6.19.6 when it comes to sound/soc/codecs/rt1011.c:
5b35bb5 ASoC: codecs: rt1011: convert to snd_soc_dapm_xxx()
6950709 ASoC: codecs: rt1011: use snd_kcontrol_chip() instead of snd_soc_kcontrol_component()

which do touches the function that NULLs out.
My guess is 5b35bb5 whcih cases dapm to be a NULL.

Can you try the attached patch on top of 6.19.6 or mainline kernel? I'm fairly confident that this will fix the kernel crash.

0001-ASoC-codecs-rt1011-Use-component-to-get-the-dapm-con.patch

[ujfalusi]

@Fisiu, I have sent the patch upstream: https://lore.kernel.org/linux-sound/20260310065350.18921-1-peter.ujfalusi@linux.intel.com/ with adding stable for backport request.