This is a note to let you know that I've just added the patch titled
ASoC: fsl_asrc_dma: fix potential null-ptr-deref
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
asoc-fsl_asrc_dma-fix-potential-null-ptr-deref.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 86a24e99c97234f87d9f70b528a691150e145197 Mon Sep 17 00:00:00 2001
From: Nikita Zhandarovich <n.zhandarovich@xxxxxxxxxx>
Date: Mon, 17 Apr 2023 06:32:42 -0700
Subject: ASoC: fsl_asrc_dma: fix potential null-ptr-deref
From: Nikita Zhandarovich <n.zhandarovich@xxxxxxxxxx>
commit 86a24e99c97234f87d9f70b528a691150e145197 upstream.
dma_request_slave_channel() may return NULL which will lead to
NULL pointer dereference error in 'tmp_chan->private'.
Correct this behaviour by, first, switching from deprecated function
dma_request_slave_channel() to dma_request_chan(). Secondly, enable
sanity check for the resuling value of dma_request_chan().
Also, fix description that follows the enacted changes and that
concerns the use of dma_request_slave_channel().
Fixes: 706e2c881158 ("ASoC: fsl_asrc_dma: Reuse the dma channel if available in Back-End")
Co-developed-by: Natalia Petrova <n.petrova@xxxxxxxxxx>
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@xxxxxxxxxx>
Acked-by: Shengjiu Wang <shengjiu.wang@xxxxxxxxx>
Link: https://lore.kernel.org/r/20230417133242.53339-1-n.zhandarovich@xxxxxxxxxx
Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
sound/soc/fsl/fsl_asrc_dma.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/sound/soc/fsl/fsl_asrc_dma.c
+++ b/sound/soc/fsl/fsl_asrc_dma.c
@@ -208,14 +208,19 @@ static int fsl_asrc_dma_hw_params(struct
be_chan = soc_component_to_pcm(component_be)->chan[substream->stream];
tmp_chan = be_chan;
}
- if (!tmp_chan)
- tmp_chan = dma_request_slave_channel(dev_be, tx ? "tx" : "rx");
+ if (!tmp_chan) {
+ tmp_chan = dma_request_chan(dev_be, tx ? "tx" : "rx");
+ if (IS_ERR(tmp_chan)) {
+ dev_err(dev, "failed to request DMA channel for Back-End\n");
+ return -EINVAL;
+ }
+ }
/*
* An EDMA DEV_TO_DEV channel is fixed and bound with DMA event of each
* peripheral, unlike SDMA channel that is allocated dynamically. So no
* need to configure dma_request and dma_request2, but get dma_chan of
- * Back-End device directly via dma_request_slave_channel.
+ * Back-End device directly via dma_request_chan.
*/
if (!asrc->use_edma) {
/* Get DMA request of Back-End */
Patches currently in stable-queue which might be from n.zhandarovich@xxxxxxxxxx are
queue-5.15/asoc-fsl_asrc_dma-fix-potential-null-ptr-deref.patch
queue-5.15/mlxfw-fix-null-ptr-deref-in-mlxfw_mfa2_tlv_next.patch
