[alsa-devel] [PATCH v2] ASoC: PXA: Fix oops in __pxa2xx_pcm_prepare

[Vasily Khoruzhick]

pxa2xx_pcm_hw_free frees dma channel and sets prtd->dma_ch to -1,
but does not set prtd->params to NULL, so if pxa2xx_pcm_hw_params will
be called immediately, it leaves prtd->dma_ch initialized with -1,
and it results in oops in __pxa2xx_pcm_prepare. This bug is triggered
via SDL.

This patch adds check for prtd->dma_ch to __pxa2xx_pcm_prepare and
cleans prtd->params, so now it works properly.

Signed-off-by: Vasily Khoruzhick <anarsoul at gmail.com>
---
v2: use -EINVAL as error in __pxa2xx_pcm_prepare if dma_ch is invalid.

 sound/arm/pxa2xx-pcm-lib.c |    3 +++
 sound/soc/pxa/pxa2xx-pcm.c |    1 +
 2 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/sound/arm/pxa2xx-pcm-lib.c b/sound/arm/pxa2xx-pcm-lib.c
index 8808b82..76e0d56 100644
--- a/sound/arm/pxa2xx-pcm-lib.c
+++ b/sound/arm/pxa2xx-pcm-lib.c
@@ -140,6 +140,9 @@ int __pxa2xx_pcm_prepare(struct snd_pcm_substream *substream)
 	if (!prtd || !prtd->params)
 		return 0;
 
+	if (prtd->dma_ch == -1)
+		return -EINVAL;
+
 	DCSR(prtd->dma_ch) &= ~DCSR_RUN;
 	DCSR(prtd->dma_ch) = 0;
 	DCMD(prtd->dma_ch) = 0;
diff --git a/sound/soc/pxa/pxa2xx-pcm.c b/sound/soc/pxa/pxa2xx-pcm.c
index 02fb664..2ce0b2d 100644
--- a/sound/soc/pxa/pxa2xx-pcm.c
+++ b/sound/soc/pxa/pxa2xx-pcm.c
@@ -65,6 +65,7 @@ static int pxa2xx_pcm_hw_free(struct snd_pcm_substream *substream)
 	if (prtd->dma_ch >= 0) {
 		pxa_free_dma(prtd->dma_ch);
 		prtd->dma_ch = -1;
+		prtd->params = NULL;
 	}
 
 	return 0;
-- 
1.7.4.1