mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/drivers/soundwire
History
Krzysztof Kozlowski 1a4da77ef6 soundwire: stream: fix NULL pointer dereference for multi_link 
commit e199bf52ff upstream.

If bus is marked as multi_link, but number of masters in the stream is
not higher than bus->hw_sync_min_links (bus->multi_link && m_rt_count >=
bus->hw_sync_min_links), bank switching should not happen.  The first
part of do_bank_switch() code properly takes these conditions into
account, but second part (sdw_ml_sync_bank_switch()) relies purely on
bus->multi_link property.  This is not balanced and leads to NULL
pointer dereference:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
  ...
  Call trace:
   wait_for_completion_timeout+0x124/0x1f0
   do_bank_switch+0x370/0x6f8
   sdw_prepare_stream+0x2d0/0x438
   qcom_snd_sdw_prepare+0xa0/0x118
   sm8450_snd_prepare+0x128/0x148
   snd_soc_link_prepare+0x5c/0xe8
   __soc_pcm_prepare+0x28/0x1ec
   dpcm_be_dai_prepare+0x1e0/0x2c0
   dpcm_fe_dai_prepare+0x108/0x28c
   snd_pcm_do_prepare+0x44/0x68
   snd_pcm_action_single+0x54/0xc0
   snd_pcm_action_nonatomic+0xe4/0xec
   snd_pcm_prepare+0xc4/0x114
   snd_pcm_common_ioctl+0x1154/0x1cc0
   snd_pcm_ioctl+0x54/0x74

Fixes: ce6e74d008 ("soundwire: Add support for multi link bank switch")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20231124180136.390621-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2023-12-20 15:17:41 +01:00
..
Kconfig
…
Makefile
…
bus.c soundwire: fix enumeration completion 2023-08-11 15:14:00 +02:00
bus.h
…
bus_type.c soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe() 2023-03-11 13:57:35 +01:00
cadence_master.c soundwire: cadence: Drain the RX FIFO after an IO timeout 2023-03-11 13:57:39 +01:00
cadence_master.h soundwire: cadence: Remove wasted space in response_buf 2023-03-11 13:57:39 +01:00
debugfs.c
…
dmi-quirks.c soundwire: dmi-quirks: add new mapping for HP Spectre x360 2023-06-28 10:29:52 +02:00
generic_bandwidth_allocation.c
…
intel.c ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire 2023-01-12 11:58:49 +01:00
intel.h
…
intel_init.c
…
master.c
…
mipi_disco.c
…
qcom.c soundwire: qcom: update status correctly with mask 2023-08-03 10:22:33 +02:00
slave.c soundwire: revisit driver bind/unbind and callbacks 2022-08-17 14:23:48 +02:00
stream.c soundwire: stream: fix NULL pointer dereference for multi_link 2023-12-20 15:17:41 +01:00
sysfs_local.h
…
sysfs_slave.c
…
sysfs_slave_dpn.c
…