This series fixes memory safety issues in the ASRC and EASRC drivers
that can be triggered by a user with access to their PCM or compress
devices:
1. fsl_asrc_m2m: the output FIFO drain can write past the end of the
output buffer.
2. fsl_asrc: a repeated hw_params() leaves a stale asrc->pair[] entry
that points to freed memory after close, and hw_free() after a
failed hw_params() can release the pair of another stream.
3. fsl_asrc_dma: DMA channels are leaked on a repeated hw_params(), and
released twice after a Back-End configuration error.
4. fsl_easrc: the same repeated hw_params() issue for EASRC contexts.
5. fsl_asrc_m2m: more than one task per compress stream leads to double
DMA channel release and a stale pair entry.
Patches 2 and 4 make the pair/context release ownership-checked; patch
5 relies on them. Please apply in order.
Validated on i.MX8MP (EASRC) and i.MX8QM (ASRC).
Stefan Ghetu (5):
ASoC: fsl_asrc_m2m: fix out-of-bounds write when draining the output
FIFO
ASoC: fsl_asrc: fix pair ownership on repeated or failed hw_params
ASoC: fsl_asrc_dma: release DMA channels on repeated hw_params
ASoC: fsl_easrc: fix context ownership on repeated hw_params
ASoC: fsl_asrc_m2m: allow only one task at a time per stream
sound/soc/fsl/fsl_asrc.c | 22 ++++++++++++++++++++++
sound/soc/fsl/fsl_asrc_dma.c | 27 ++++++++++++++++++---------
sound/soc/fsl/fsl_asrc_m2m.c | 25 +++++++++++++++++--------
sound/soc/fsl/fsl_easrc.c | 10 ++++++++++
4 files changed, 67 insertions(+), 17 deletions(-)
base-commit: b810335a0699d1810683796b0e3ffe8827ddfe6c
--
2.53.0
