Re: [PATCH v7 07/18] ASoC: rsnd: Refactor DMA address tables with named structs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Potential NULL pointer dereference in rsnd_ssi_use_busif if the stream lacks an SSI component.
--

commit c7d64665ffb93009db59da73396bbe58b794f096
Author: John Madieu <john.madieu.xa@bp.renesas.com>

ASoC: rsnd: Refactor DMA address tables with named structs

This commit replaces the raw multi-dimensional array used for DMA address
lookup in rsnd_gen2_dma_addr() with named structs. It also extracts the
common lookup logic into a shared rsnd_dma_addr_lookup() function to
prepare for upcoming RZ/G3E support.

> diff --git a/sound/soc/renesas/rcar/dma.c b/sound/soc/renesas/rcar/dma.c
> index d52cada711e50..0ce77eee338da 100644
> --- a/sound/soc/renesas/rcar/dma.c
> +++ b/sound/soc/renesas/rcar/dma.c

[ ... ]

> @@ -481,6 +481,69 @@ static struct rsnd_mod_ops rsnd_dmapp_ops = {
>  	DEBUG_INFO
>  };
>  
> +struct rsnd_dma_addr {

[ ... ]

> +static dma_addr_t
> +rsnd_dma_addr_lookup(struct rsnd_dai_stream *io,
> +		     struct rsnd_mod *mod,
> +		     struct rsnd_priv *priv,
> +		     const struct rsnd_dma_addr_map *map,
> +		     int is_play, int is_from)
> +{

[ ... ]

> +	/* use SSIU or SSI? */
> +	if (is_ssi && rsnd_ssi_use_busif(io))

[Severity: High]
This is a pre-existing issue, but could this lead to a NULL pointer
dereference if the stream lacks an SSI component?

If a device tree specifies a DAI link that includes an SSIU module but
omits an SSI module, rsnd_io_to_mod_ssi() will return NULL.

When rsnd_ssi_use_busif() is called, it unconditionally passes this NULL
module to rsnd_ssi_is_dma_mode(), which dereferences the ops struct:

sound/soc/renesas/rcar/ssi.c:rsnd_ssi_use_busif() {
	struct rsnd_mod *mod = rsnd_io_to_mod_ssi(io);
	...
	if (!rsnd_ssi_is_dma_mode(mod))
		return 0;
	...
}

Would it be safer for rsnd_ssi_use_busif() to verify the module exists
before checking its DMA mode, allowing a malformed device tree to
fail gracefully instead of causing a panic?

> +		is_ssi++;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260525110230.4014435-1-john.madieu.xa@bp.renesas.com?part=7