Commit 545967e7 authored by Amelie Delaunay's avatar Amelie Delaunay Committed by Lin Ruifeng
Browse files

ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove 

stable inclusion
from stable-v5.10.230
commit 3a977b554f668382dfba31fd62e4cce4fe5643db
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVR
CVE: CVE-2024-50292

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3a977b554f668382dfba31fd62e4cce4fe5643db



--------------------------------

[ Upstream commit 9bb4af400c386374ab1047df44c508512c08c31f ]

In case of error when requesting ctrl_chan DMA channel, ctrl_chan is not
null. So the release of the dma channel leads to the following issue:
[    4.879000] st,stm32-spdifrx 500d0000.audio-controller:
dma_request_slave_channel error -19
[    4.888975] Unable to handle kernel NULL pointer dereference
at virtual address 000000000000003d
[...]
[    5.096577] Call trace:
[    5.099099]  dma_release_channel+0x24/0x100
[    5.103235]  stm32_spdifrx_remove+0x24/0x60 [snd_soc_stm32_spdifrx]
[    5.109494]  stm32_spdifrx_probe+0x320/0x4c4 [snd_soc_stm32_spdifrx]

To avoid this issue, release channel only if the pointer is valid.

Fixes: 794df944 ("ASoC: stm32: spdifrx: manage rebind issue")
Signed-off-by: default avatarAmelie Delaunay <amelie.delaunay@foss.st.com>
Signed-off-by: default avatarOlivier Moysan <olivier.moysan@foss.st.com>
Link: https://patch.msgid.link/20241105140242.527279-1-olivier.moysan@foss.st.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLin Ruifeng <linruifeng4@huawei.com>
parent 020e0507

sound/soc/stm/stm32_spdifrx.c

+1 −1
Original line number Diff line number Diff line
@@ -948,7 +948,7 @@ static int stm32_spdifrx_remove(struct platform_device *pdev) 
{

	struct stm32_spdifrx_data *spdifrx = platform_get_drvdata(pdev);



	if (spdifrx->ctrl_chan)

	if (!IS_ERR(spdifrx->ctrl_chan))

		dma_release_channel(spdifrx->ctrl_chan);



	if (spdifrx->dmab)