Re: [PATCH v7 08/18] ASoC: rsnd: Add RZ/G3E DMA address calculation support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Potential NULL pointer dereference in rsnd_rzg3e_dma_addr() when evaluating the bus interface (busif) if the SSIU module is absent. This problem wasn't introduced by this patch, but was copied from the pre-existing rsnd_gen2_dma_addr() function and propagated to the new RZ/G3E platform.
--

commit 81338bf6d6c4e6f1f0cb642937dcc5c87e6a300d
Author: John Madieu <john.madieu.xa@bp.renesas.com>

ASoC: rsnd: Add RZ/G3E DMA address calculation support

This commit adds RZ/G3E DMA address calculation support to the rsnd
driver. It implements a dedicated rsnd_rzg3e_dma_addr function to
handle the different register base addresses and offsets for this SoC.

> diff --git a/sound/soc/renesas/rcar/dma.c b/sound/soc/renesas/rcar/dma.c
> index 0ce77eee338da..92974610ac153 100644
> --- a/sound/soc/renesas/rcar/dma.c
> +++ b/sound/soc/renesas/rcar/dma.c
[ ... ]
> @@ -644,6 +644,85 @@ rsnd_gen2_dma_addr(struct rsnd_dai_stream *io,
[ ... ]
> +static dma_addr_t
> +rsnd_rzg3e_dma_addr(struct rsnd_dai_stream *io,
> +		    struct rsnd_mod *mod, int is_play, int is_from)
> +{
> +	struct rsnd_priv *priv = rsnd_io_to_priv(io);
> +	phys_addr_t ssi_reg = rsnd_gen_get_phy_addr(priv, RSND_BASE_SSI);
> +	phys_addr_t src_reg = rsnd_gen_get_phy_addr(priv, RSND_BASE_SCU);
> +	int id    = rsnd_mod_id(mod);
> +	int busif = rsnd_mod_id_sub(rsnd_io_to_mod_ssiu(io));

[Severity: High]
This is a pre-existing issue, but can this lead to a NULL pointer dereference
if the SSIU module is absent?

If the device tree configures the SSI module for PIO mode, the SSIU module
might not be connected to the audio stream, meaning rsnd_io_to_mod_ssiu(io)
evaluates to NULL.

If another module in the pipeline, such as SRC, unconditionally requests DMA
during probe, rsnd_dma_alloc() will determine the DMA path and call
rsnd_rzg3e_dma_addr().

Since rsnd_mod_id_sub() does not check for a NULL mod pointer:

sound/soc/renesas/rcar/core.c:rsnd_mod_id_sub() {
        if ((mod)->ops->id_sub)
                return (mod)->ops->id_sub(mod);
        return 0;
}

Could evaluating rsnd_mod_id_sub(rsnd_io_to_mod_ssiu(io)) here trigger a kernel
panic on probe with a misconfigured device tree? Should this be handled
gracefully instead?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260525110230.4014435-1-john.madieu.xa@bp.renesas.com?part=8