The rz_ssi_dma_request function only checks the NULL condition for
the value returned by the dma_request_chan function, but this function
can also return an error. If it happens, the subsequent function call to
rz_ssi_dma_slave_config can lead to a kernel crash.
This patch fixes the issue by checking both error and NULL condition
returned by dma_request_chan.
Signed-off-by: Biju Das <biju.das.jz@xxxxxxxxxxxxxx>
---
sound/soc/sh/rz-ssi.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c
index ea8d33ede5d2..3867e2efd3e0 100644
--- a/sound/soc/sh/rz-ssi.c
+++ b/sound/soc/sh/rz-ssi.c
@@ -676,11 +676,19 @@ static void rz_ssi_release_dma_channels(struct rz_ssi_priv *ssi)
static int rz_ssi_dma_request(struct rz_ssi_priv *ssi, struct device *dev)
{
ssi->playback.dma_ch = dma_request_chan(dev, "tx");
+ if (IS_ERR_OR_NULL(ssi->playback.dma_ch))
+ ssi->playback.dma_ch = NULL;
+
ssi->capture.dma_ch = dma_request_chan(dev, "rx");
+ if (IS_ERR_OR_NULL(ssi->capture.dma_ch))
+ ssi->capture.dma_ch = NULL;
+
if (!ssi->playback.dma_ch && !ssi->capture.dma_ch) {
ssi->playback.dma_ch = dma_request_chan(dev, "rt");
- if (!ssi->playback.dma_ch)
+ if (IS_ERR_OR_NULL(ssi->playback.dma_ch)) {
+ ssi->playback.dma_ch = NULL;
goto no_dma;
+ }
ssi->dma_rt = true;
}
--
2.17.1
