Re: [PATCH v8 08/10] ASoC: qcom: Add QAIF IRQ handling and platform register

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] soc: qcom: premature stream publication leads to UAF in IRQ
- [Medium] soc: qcom: uninitialized stack read of iommu_spec.args
- [Medium] soc: qcom: early return on teardown failure leaves IRQs active
--

commit 324410c825bd2c2f359bf015a0cb8ddd83bf98e2
Author: Harendra Gautam <harendra.gautam@oss.qualcomm.com>
ASoC: qcom: Add QAIF IRQ handling and platform register

This commit finishes the QAIF PCM platform support by adding stream
registration and DMA interrupt servicing. It registers the ASoC component,
requests the QAIF interrupt, handles triggers, and dispatches IRQs to the
AIF and CIF handlers.

> diff --git a/sound/soc/qcom/qaif-platform.c b/sound/soc/qcom/qaif-platform.c
> index e24c4252825e2..aa452ce4140fb 100644
> --- a/sound/soc/qcom/qaif-platform.c
> +++ b/sound/soc/qcom/qaif-platform.c
[ ... ]
> @@ -462,3 +462,395 @@ static int qaif_platform_pcm_new(struct snd_soc_component *component,
[ ... ]
> +static int qaif_platform_pcmops_trigger(struct snd_soc_component *component,
> +					struct snd_pcm_substream *substream,
> +					int cmd)
> +{
[ ... ]
> +	case SNDRV_PCM_TRIGGER_STOP:
> +	case SNDRV_PCM_TRIGGER_SUSPEND:
> +	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
> +		ret = regmap_update_bits(map,
> +					 qaif_dmactl_reg(v, idx, substream->stream, dai_id),
> +					 QAIF_DMACTL_ENABLE_BIT, 0);
> +		if (ret) {
> +			dev_err(soc_runtime->dev, "error disabling DMA: %d\n", ret);
> +			return ret;
> +		}

[Severity: Medium]
If regmap_update_bits() fails, this returns early. Since the subsequent
call to disable IRQs (qaif_platform_irq_op(..., QAIF_IRQ_DISABLE)) is
skipped, could this leave hardware IRQs active and cause an interrupt storm
during teardown?

[ ... ]
> +static irqreturn_t qaif_process_dma_irq(struct qaif_drv_data *drvdata,
> +					u32 stat_reg_addr,
> +					u32 clr_reg_addr,
> +					enum qaif_irq_type irq_type,
> +					enum qaif_dma_dir dma_type,
> +					enum qaif_irq irq,
> +					struct snd_pcm_substream **substream)
> +{
[ ... ]
> +	for (dma_idx = 0; dma_idx < num_dma; dma_idx++) {
> +		stream_dma_idx = dma_idx + stream_offset;
> +		ss = READ_ONCE(substream[stream_dma_idx]);

[Severity: High]
Is there a race condition with qaif_platform_pcmops_open() publishing the
stream before checking constraints?

In qaif_platform_pcmops_open(), the substream pointer is published to the
array early:

	if (qaif_is_cif_port(dai_id))
		WRITE_ONCE(drvdata->cif_substream[stream_dma_idx], substream);
	else
		WRITE_ONCE(drvdata->aif_substream[stream_dma_idx], substream);

If a subsequent hardware constraint check fails, the array entry is set to NULL
and the error is returned, causing ALSA to free the substream. 

Since there is no synchronize_irq() on the open error path, could a spurious
interrupt be handled here and dereference the ss pointer after it has been
freed?

[ ... ]
> +int asoc_qcom_qaif_platform_register(struct platform_device *pdev)
> +{
> +	struct qaif_drv_data *drvdata = platform_get_drvdata(pdev);
> +	struct of_phandle_args iommu_spec;
> +	u32 sid;
> +	int ret;
> +
> +	if (!drvdata->variant->alloc_stream_dma_idx ||
> +	    !drvdata->variant->free_stream_dma_idx)
> +		return dev_err_probe(&pdev->dev, -EINVAL,
> +				     "Variant missing mandatory callbacks\n");
> +
> +	ret = of_parse_phandle_with_args(pdev->dev.of_node,
> +					 "iommus", "#iommu-cells", 0,
> +					 &iommu_spec);
> +	if (ret)
> +		return dev_err_probe(&pdev->dev, ret,
> +				     "failed to parse iommus property\n");
> +	sid = iommu_spec.args[0];

[Severity: Medium]
If a device tree specifies #iommu-cells = <0> (or it is missing and handled
as 0), of_parse_phandle_with_args() will succeed with args_count = 0. Does
this leave the stack variable iommu_spec.args[0] uninitialized when it is
read here and assigned to sid?

> +	of_node_put(iommu_spec.np);
> +	drvdata->smmu_csid_bits = sid & QAIF_CSID_MASK;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928-b4-qaif-shikra-audio-v8-0-ac618057fe85@oss.qualcomm.com?part=8