• Krzysztof Kozlowski's avatar
    soundwire: stream: fix NULL pointer dereference for multi_link · e199bf52
    Krzysztof Kozlowski authored
    If bus is marked as multi_link, but number of masters in the stream is
    not higher than bus->hw_sync_min_links (bus->multi_link && m_rt_count >=
    bus->hw_sync_min_links), bank switching should not happen.  The first
    part of do_bank_switch() code properly takes these conditions into
    account, but second part (sdw_ml_sync_bank_switch()) relies purely on
    bus->multi_link property.  This is not balanced and leads to NULL
    pointer dereference:
    
      Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
      ...
      Call trace:
       wait_for_completion_timeout+0x124/0x1f0
       do_bank_switch+0x370/0x6f8
       sdw_prepare_stream+0x2d0/0x438
       qcom_snd_sdw_prepare+0xa0/0x118
       sm8450_snd_prepare+0x128/0x148
       snd_soc_link_prepare+0x5c/0xe8
       __soc_pcm_prepare+0x28/0x1ec
       dpcm_be_dai_prepare+0x1e0/0x2c0
       dpcm_fe_dai_prepare+0x108/0x28c
       snd_pcm_do_prepare+0x44/0x68
       snd_pcm_action_single+0x54/0xc0
       snd_pcm_action_nonatomic+0xe4/0xec
       snd_pcm_prepare+0xc4/0x114
       snd_pcm_common_ioctl+0x1154/0x1cc0
       snd_pcm_ioctl+0x54/0x74
    
    Fixes: ce6e74d0 ("soundwire: Add support for multi link bank switch")
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Reviewed-by: default avatarPierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Link: https://lore.kernel.org/r/20231124180136.390621-1-krzysztof.kozlowski@linaro.orgSigned-off-by: default avatarVinod Koul <vkoul@kernel.org>
    e199bf52
stream.c 49.7 KB