Re: [PATCH] ASoC: fsl_asrc_dma: fix potential null-ptr-deref

On Mon, Apr 17, 2023 at 9:33 PM Nikita Zhandarovich < n.zhandarovich@fintech.ru> wrote:

dma_request_slave_channel() may return NULL which will lead to NULL pointer dereference error in 'tmp_chan->private'.

Correct this behaviour by, first, switching from deprecated function dma_request_slave_channel() to dma_request_chan(). Secondly, enable sanity check for the resuling value of dma_request_chan(). Also, fix description that follows the enacted changes and that concerns the use of dma_request_slave_channel().

Fixes: 706e2c881158 ("ASoC: fsl_asrc_dma: Reuse the dma channel if available in Back-End") Co-developed-by: Natalia Petrova n.petrova@fintech.ru Signed-off-by: Nikita Zhandarovich n.zhandarovich@fintech.ru

Acked-by: Shengjiu Wang shengjiu.wang@gmail.com

Best regards wang shengjiu

---

sound/soc/fsl/fsl_asrc_dma.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c index 3b81a465814a..05a7d1588d20 100644 --- a/sound/soc/fsl/fsl_asrc_dma.c +++ b/sound/soc/fsl/fsl_asrc_dma.c @@ -209,14 +209,19 @@ static int fsl_asrc_dma_hw_params(struct snd_soc_component *component, be_chan = soc_component_to_pcm(component_be)->chan[substream->stream]; tmp_chan = be_chan; }

•   if (!tmp_chan)
  

•           tmp_chan = dma_request_slave_channel(dev_be, tx ? "tx" :
  

"rx");

•   if (!tmp_chan) {
  

•           tmp_chan = dma_request_chan(dev_be, tx ? "tx" : "rx");
  

•           if (IS_ERR(tmp_chan)) {
  

•                   dev_err(dev, "failed to request DMA channel for
  

Back-End\n");

•                   return -EINVAL;
  

•           }
  

•   }
  
    /*
     * An EDMA DEV_TO_DEV channel is fixed and bound with DMA event of
  

each * peripheral, unlike SDMA channel that is allocated dynamically. So no * need to configure dma_request and dma_request2, but get dma_chan of

•    * Back-End device directly via dma_request_slave_channel.
  

•    * Back-End device directly via dma_request_chan.
     */
    if (!asrc->use_edma) {
            /* Get DMA request of Back-End */