[PATCH] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM

[Ammar Faizi]

On 2/24/22 11:53 PM, Péter Ujfalusi wrote:
> On 24/02/2022 16:51, Ammar Faizi wrote:
>> From: Ammar Faizi <ammarfaizi2 at gnuweeb.org>
>>
>> Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns
>> -ENOMEM because it leads to a NULL pointer dereference bug.
> 
> Reviewed-by: Peter Ujfalusi <peter.ujfalusi at linux.intel.com>

Thanks for the review, I will append this tag in the v2.

>> The dmesg says:
>>
>>    <6>[109482.497835][T138537] usb 1-2: Manufacturer: SIGMACHIP
>>    <6>[109482.502506][T138537] input: SIGMACHIP USB Keyboard as /devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0/0003:1C4F:0002.000D/input/input34
>>    <6>[109482.558976][T138537] hid-generic 0003:1C4F:0002.000D: input,hidraw1: USB HID v1.10 Keyboard [SIGMACHIP USB Keyboard] on usb-0000:00:14.0-2/input0
>>    <6>[109482.561653][T138537] input: SIGMACHIP USB Keyboard Consumer Control as /devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1/0003:1C4F:0002.000E/input/input35
>>    <6>[109482.615490][T138537] input: SIGMACHIP USB Keyboard System Control as /devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1/0003:1C4F:0002.000E/input/input36
>>    <6>[109482.615643][T138537] hid-generic 0003:1C4F:0002.000E: input,hidraw2: USB HID v1.10 Device [SIGMACHIP USB Keyboard] on usb-0000:00:14.0-2/input1
>>    <4>[110102.335460][T140985] rtw_8822ce 0000:01:00.0: timed out to flush queue 1
>>    <3>[118575.730928][ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12
> 
> Wow, I wonder what is going on that allocation fails...

Can't really tell the reason behind the -ENOMEM.

It's hard to reproduce, randomly happens. I have hit this bug
at least 4 times on my laptop with 16 GB of RAM. All happened
randomly.

I tried to torture the memory with mmap() + mlock() + memset()
+ sleep(), then playing some audio while almost running out of
memory, but still can't reproduce the same -ENOMEM.

-- 
Ammar Faizi
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x364FBA34FF170A4B.asc
Type: application/pgp-keys
Size: 1765 bytes
Desc: OpenPGP public key
URL: <http://mailman.alsa-project.org/pipermail/alsa-devel/attachments/20220225/812db67e/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <http://mailman.alsa-project.org/pipermail/alsa-devel/attachments/20220225/812db67e/attachment-0001.sig>