[lvc-project] [PATCH] ASoC: fsl_asrc_dma: fix potential null-ptr-deref

[Shengjiu Wang]

On Mon, Apr 17, 2023 at 9:33 PM Nikita Zhandarovich <
n.zhandarovich at fintech.ru> wrote:

> dma_request_slave_channel() may return NULL which will lead to
> NULL pointer dereference error in 'tmp_chan->private'.
>
> Correct this behaviour by, first, switching from deprecated function
> dma_request_slave_channel() to dma_request_chan(). Secondly, enable
> sanity check for the resuling value of dma_request_chan().
> Also, fix description that follows the enacted changes and that
> concerns the use of dma_request_slave_channel().
>
> Fixes: 706e2c881158 ("ASoC: fsl_asrc_dma: Reuse the dma channel if
> available in Back-End")
> Co-developed-by: Natalia Petrova <n.petrova at fintech.ru>
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich at fintech.ru>
>

Acked-by: Shengjiu Wang <shengjiu.wang at gmail.com>

Best regards
wang shengjiu

> ---
>  sound/soc/fsl/fsl_asrc_dma.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c
> index 3b81a465814a..05a7d1588d20 100644
> --- a/sound/soc/fsl/fsl_asrc_dma.c
> +++ b/sound/soc/fsl/fsl_asrc_dma.c
> @@ -209,14 +209,19 @@ static int fsl_asrc_dma_hw_params(struct
> snd_soc_component *component,
>                 be_chan =
> soc_component_to_pcm(component_be)->chan[substream->stream];
>                 tmp_chan = be_chan;
>         }
> -       if (!tmp_chan)
> -               tmp_chan = dma_request_slave_channel(dev_be, tx ? "tx" :
> "rx");
> +       if (!tmp_chan) {
> +               tmp_chan = dma_request_chan(dev_be, tx ? "tx" : "rx");
> +               if (IS_ERR(tmp_chan)) {
> +                       dev_err(dev, "failed to request DMA channel for
> Back-End\n");
> +                       return -EINVAL;
> +               }
> +       }
>
>         /*
>          * An EDMA DEV_TO_DEV channel is fixed and bound with DMA event of
> each
>          * peripheral, unlike SDMA channel that is allocated dynamically.
> So no
>          * need to configure dma_request and dma_request2, but get
> dma_chan of
> -        * Back-End device directly via dma_request_slave_channel.
> +        * Back-End device directly via dma_request_chan.
>          */
>         if (!asrc->use_edma) {
>                 /* Get DMA request of Back-End */
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://linuxtesting.org/pipermail/lvc-project/attachments/20230419/af397e9f/attachment.html>