Re: [PATCH v2 4/5] ASoC: fsl_asrc: expose individual DAIs per conversion path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Calling `hw_params` multiple times leaks channel availability, exhausts pair slots, and leaves dangling pointers leading to Use-After-Free.
--

--- Patch [4]: [PATCH v2 4/5] ASoC: fsl_asrc: expose individual DAIs per conversion path ---
commit f590fa927b95ce1e6a86c0ad704e429857c29260
Author: Shengjiu Wang <shengjiu.wang@nxp.com>

ASoC: fsl_asrc: expose individual DAIs per conversion path

The i.MX ASRC hardware supports three independent conversion pairs. This
commit replaces the single fsl_asrc_dai instance with an array of three DAI
drivers to allow independent conversion paths to be active simultaneously,
retaining backward compatibility for asrc-0.

> diff --git a/sound/soc/fsl/fsl_asrc.c b/sound/soc/fsl/fsl_asrc.c
> index 2755ee57c6a17..a5d6c4c1e9292 100644
> --- a/sound/soc/fsl/fsl_asrc.c
> +++ b/sound/soc/fsl/fsl_asrc.c
[ ... ]
> @@ -792,27 +792,76 @@ static const struct snd_soc_dai_ops fsl_asrc_dai_ops = {
>  				 SNDRV_PCM_FMTBIT_S16_LE | \
>  				 SNDRV_PCM_FMTBIT_S24_3LE)
>  
> -static struct snd_soc_dai_driver fsl_asrc_dai = {
> -	.playback = {
[ ... ]
> +static struct snd_soc_dai_driver fsl_asrc_dai[] = {
> +	{
> +		.name = "asrc-0",
> +		.playback = {
> +			.stream_name = "ASRC-Playback",
> +			.channels_min = 1,
> +			.channels_max = 10,
> +			.rate_min = 5512,
> +			.rate_max = 192000,
> +			.rates = SNDRV_PCM_RATE_KNOT,
> +			.formats = FSL_ASRC_FORMATS |
> +				   SNDRV_PCM_FMTBIT_S8,
> +		},
> +		.capture = {
> +			.stream_name = "ASRC-Capture",
> +			.channels_min = 1,
> +			.channels_max = 10,
> +			.rate_min = 5512,
> +			.rate_max = 192000,
> +			.rates = SNDRV_PCM_RATE_KNOT,
> +			.formats = FSL_ASRC_FORMATS,
> +		},
> +		.ops = &fsl_asrc_dai_ops,

[Severity: High]
This is a pre-existing issue, but since this patch exposes multiple DAIs that
share these operations, could calling hw_params multiple times on an open
stream lead to a use-after-free?

ALSA allows userspace to call SNDRV_PCM_IOCTL_HW_PARAMS multiple times.
Looking at fsl_asrc_dai_hw_params(), it unconditionally requests a new pair:

sound/soc/fsl/fsl_asrc.c:fsl_asrc_dai_hw_params() {
    ...
	ret = fsl_asrc_request_pair(channels, pair);
	if (ret) {
    ...
}

In fsl_asrc_request_pair(), the loop finds the next NULL slot, skipping any
slot that already contains the same pair pointer:

sound/soc/fsl/fsl_asrc.c:fsl_asrc_request_pair() {
    ...
	for (i = ASRC_PAIR_A; i < ASRC_PAIR_MAX_NUM; i++) {
		if (asrc->pair[i] != NULL)
			continue;

		index = i;
    ...
}

Does this populate multiple slots in asrc->pair[] with the same pointer while
overwriting pair->index with the newest index? 

If so, when the stream is closed, fsl_asrc_dma_shutdown() clears only the
latest index before freeing the pair. Older slots might permanently retain
pointers to the freed memory, leading to a use-after-free when fsl_asrc_isr()
or fsl_asrc_m2m_suspend() iterates over the pairs.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723022313.1905051-1-shengjiu.wang@oss.nxp.com?part=4