fsl_asrc_dma_hw_params() requests new DMA channels on every call and
overwrites the previous ones, which are leaked when hw_params() is
called again without hw_free(). Its Back-End error path also releases a
channel without clearing the pointer, so the following hw_free()
releases it a second time.

Release the channels of a previous call first, and clear the pointer in
the error path.

Fixes: 3117bb3109dc ("ASoC: fsl_asrc: Add ASRC ASoC CPU DAI and platform 
drivers")
Fixes: 36124fb19f1a ("ASoC: fsl_asrc_dma: Fix dma_chan leak when config DMA 
channel failed")
Signed-off-by: Stefan Ghetu <[email protected]>
---
 sound/soc/fsl/fsl_asrc_dma.c | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c
index b417de6abebe..5ba4bdeff019 100644
--- a/sound/soc/fsl/fsl_asrc_dma.c
+++ b/sound/soc/fsl/fsl_asrc_dma.c
@@ -124,6 +124,19 @@ static int fsl_asrc_dma_trigger(struct snd_soc_component 
*component,
        return 0;
 }
 
+static void fsl_asrc_dma_release_chans(struct fsl_asrc_pair *pair, u8 dir)
+{
+       if (pair->dma_chan[!dir])
+               dma_release_channel(pair->dma_chan[!dir]);
+
+       /* release dev_to_dev chan if we aren't reusing the Back-End one */
+       if (pair->dma_chan[dir] && pair->req_dma_chan)
+               dma_release_channel(pair->dma_chan[dir]);
+
+       pair->dma_chan[!dir] = NULL;
+       pair->dma_chan[dir] = NULL;
+}
+
 static int fsl_asrc_dma_hw_params(struct snd_soc_component *component,
                                  struct snd_pcm_substream *substream,
                                  struct snd_pcm_hw_params *params)
@@ -190,6 +203,9 @@ static int fsl_asrc_dma_hw_params(struct snd_soc_component 
*component,
        dma_params_fe->addr = asrc->paddr + asrc->get_fifo_addr(!dir, index);
        dma_params_fe->maxburst = dma_params_be->maxburst;
 
+       /* hw_params() may be called again without hw_free() in between */
+       fsl_asrc_dma_release_chans(pair, dir);
+
        tmp_chan = asrc->get_dma_channel(pair, !dir);
        if (IS_ERR(tmp_chan)) {
                dev_err(dev, "failed to request DMA channel\n");
@@ -342,6 +358,7 @@ static int fsl_asrc_dma_hw_params(struct snd_soc_component 
*component,
                dev_err(dev, "failed to config DMA channel for Back-End\n");
                if (pair->req_dma_chan)
                        dma_release_channel(pair->dma_chan[dir]);
+               pair->dma_chan[dir] = NULL;
                return ret;
        }
 
@@ -356,15 +373,7 @@ static int fsl_asrc_dma_hw_free(struct snd_soc_component 
*component,
        struct fsl_asrc_pair *pair = runtime->private_data;
        u8 dir = tx ? OUT : IN;
 
-       if (pair->dma_chan[!dir])
-               dma_release_channel(pair->dma_chan[!dir]);
-
-       /* release dev_to_dev chan if we aren't reusing the Back-End one */
-       if (pair->dma_chan[dir] && pair->req_dma_chan)
-               dma_release_channel(pair->dma_chan[dir]);
-
-       pair->dma_chan[!dir] = NULL;
-       pair->dma_chan[dir] = NULL;
+       fsl_asrc_dma_release_chans(pair, dir);
 
        return 0;
 }
-- 
2.53.0


Reply via email to