The rz_ssi_dma_request function only checks the NULL condition for the value returned by the dma_request_chan function, but this function can also return an error. If it happens, the subsequent function call to rz_ssi_dma_slave_config can lead to a kernel crash.
This patch fixes the issue by checking both error and NULL condition returned by dma_request_chan.
Signed-off-by: Biju Das biju.das.jz@bp.renesas.com --- sound/soc/sh/rz-ssi.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c index ea8d33ede5d2..3867e2efd3e0 100644 --- a/sound/soc/sh/rz-ssi.c +++ b/sound/soc/sh/rz-ssi.c @@ -676,11 +676,19 @@ static void rz_ssi_release_dma_channels(struct rz_ssi_priv *ssi) static int rz_ssi_dma_request(struct rz_ssi_priv *ssi, struct device *dev) { ssi->playback.dma_ch = dma_request_chan(dev, "tx"); + if (IS_ERR_OR_NULL(ssi->playback.dma_ch)) + ssi->playback.dma_ch = NULL; + ssi->capture.dma_ch = dma_request_chan(dev, "rx"); + if (IS_ERR_OR_NULL(ssi->capture.dma_ch)) + ssi->capture.dma_ch = NULL; + if (!ssi->playback.dma_ch && !ssi->capture.dma_ch) { ssi->playback.dma_ch = dma_request_chan(dev, "rt"); - if (!ssi->playback.dma_ch) + if (IS_ERR_OR_NULL(ssi->playback.dma_ch)) { + ssi->playback.dma_ch = NULL; goto no_dma; + }
ssi->dma_rt = true; }