linux-kernel - [PATCH 1/1] ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241105140242.527279-1-olivier.moysan@foss.st.com>
Date: Tue, 5 Nov 2024 15:02:42 +0100
From: Olivier Moysan <olivier.moysan@...s.st.com>
To: <amelie.delaunay@...s.st.com>,
        Olivier Moysan
	<olivier.moysan@...s.st.com>,
        Arnaud Pouliquen
	<arnaud.pouliquen@...s.st.com>,
        Liam Girdwood <lgirdwood@...il.com>,
        "Mark
 Brown" <broonie@...nel.org>, Jaroslav Kysela <perex@...ex.cz>,
        Takashi Iwai
	<tiwai@...e.com>,
        Maxime Coquelin <mcoquelin.stm32@...il.com>,
        "Alexandre
 Torgue" <alexandre.torgue@...s.st.com>
CC: Olivier Moysan <olivier.moysan@...com>, <linux-sound@...r.kernel.org>,
        <linux-stm32@...md-mailman.stormreply.com>,
        <linux-arm-kernel@...ts.infradead.org>, <linux-kernel@...r.kernel.org>
Subject: [PATCH 1/1] ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove

From: Amelie Delaunay <amelie.delaunay@...s.st.com>

In case of error when requesting ctrl_chan DMA channel, ctrl_chan is not
null. So the release of the dma channel leads to the following issue:
[    4.879000] st,stm32-spdifrx 500d0000.audio-controller:
dma_request_slave_channel error -19
[    4.888975] Unable to handle kernel NULL pointer dereference
at virtual address 000000000000003d
[...]
[    5.096577] Call trace:
[    5.099099]  dma_release_channel+0x24/0x100
[    5.103235]  stm32_spdifrx_remove+0x24/0x60 [snd_soc_stm32_spdifrx]
[    5.109494]  stm32_spdifrx_probe+0x320/0x4c4 [snd_soc_stm32_spdifrx]

To avoid this issue, release channel only if the pointer is valid.

Fixes: 794df9448edb ("ASoC: stm32: spdifrx: manage rebind issue")
Signed-off-by: Amelie Delaunay <amelie.delaunay@...s.st.com>
Signed-off-by: Olivier Moysan <olivier.moysan@...s.st.com>
---
 sound/soc/stm/stm32_spdifrx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/stm/stm32_spdifrx.c b/sound/soc/stm/stm32_spdifrx.c
index d1b32ba1e1a2..9e30852de93c 100644
--- a/sound/soc/stm/stm32_spdifrx.c
+++ b/sound/soc/stm/stm32_spdifrx.c
@@ -939,7 +939,7 @@ static void stm32_spdifrx_remove(struct platform_device *pdev)
 {
 	struct stm32_spdifrx_data *spdifrx = platform_get_drvdata(pdev);
 
-	if (spdifrx->ctrl_chan)
+	if (!IS_ERR(spdifrx->ctrl_chan))
 		dma_release_channel(spdifrx->ctrl_chan);
 
 	if (spdifrx->dmab)
-- 
2.25.1