Re: [PATCH v1 5/7] ASoC: fsl_asrc: Replace dma_request_slave_channel() by dma_request_chan()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] sound: fsl_asrc: dma_release_channel() dereferences ERR_PTR in fsl_asrc_dma_hw_free
--

commit 6b21fbae024779272022d29e64403ad02a43c0a2
Author: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Subject: ASoC: fsl_asrc: Replace dma_request_slave_channel() by dma_request_chan()

This patch replaces the deprecated dma_request_slave_channel() API with
dma_request_chan() across the fsl_asrc driver.

> diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c
> index 2f662bdf14d07..5cd12781c6042 100644
> --- a/sound/soc/fsl/fsl_asrc_dma.c
> +++ b/sound/soc/fsl/fsl_asrc_dma.c
> @@ -191,9 +191,10 @@ static int fsl_asrc_dma_hw_params(struct snd_soc_component *component,
>  	dma_params_fe->maxburst = dma_params_be->maxburst;
>  
>  	pair->dma_chan[!dir] = asrc->get_dma_channel(pair, !dir);
> -	if (!pair->dma_chan[!dir]) {
> +	ret = PTR_ERR_OR_ZERO(pair->dma_chan[!dir]);
> +	if (ret) {
>  		dev_err(dev, "failed to request DMA channel\n");
> -		return -EINVAL;
> +		return ret;
>  	}

[Severity: High]
Will this cause a panic in fsl_asrc_dma_hw_free() if get_dma_channel()
fails?

Since dma_request_chan() returns an ERR_PTR on failure, pair->dma_chan[!dir]
will now store an ERR_PTR instead of NULL when the DMA channel request fails.

If hw_params fails here, the ALSA PCM core handles the failure by invoking
the component's hw_free callback to clean up partially allocated resources.
That function checks if the channel pointer is truthy:

sound/soc/fsl/fsl_asrc_dma.c:fsl_asrc_dma_hw_free() {
    ...
    if (pair->dma_chan[!dir])
        dma_release_channel(pair->dma_chan[!dir]);
    ...
}

Since an ERR_PTR evaluates to true, dma_release_channel() is called with the
ERR_PTR, which will cause an invalid memory access and an immediate kernel
panic when it attempts to read chan->client_count.

Does fsl_asrc_dma_hw_free() need to be updated to use IS_ERR_OR_NULL()
instead, or should we reset pair->dma_chan[!dir] to NULL here on failure?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915100931.3593242-1-andriy.shevchenko@linux.intel.com?part=5