On Tue, Nov 10, 2026 at 8:08 PM Stefan Ghetu <[email protected]> wrote: > > hw_params() can be called again without hw_free() in between. > fsl_easrc_hw_params() then requests a second context while the stream > still owns the first one, which is never released. After close, that > easrc->pair[] entry points to freed memory and is dereferenced by > fsl_easrc_runtime_resume() on the next open. > > The EASRC slots depend on the number of channels, so release the owned > context before requesting a new one, and make > fsl_easrc_release_context() ignore a context it does not own. > > Fixes: 955ac624058f ("ASoC: fsl_easrc: Add EASRC ASoC CPU DAI drivers") > Signed-off-by: Stefan Ghetu <[email protected]>
Reviewed-by: Shengjiu Wang <[email protected]> best regards shengjiu Wang > --- > sound/soc/fsl/fsl_easrc.c | 10 ++++++++++ > 1 file changed, 10 insertions(+) > > diff --git a/sound/soc/fsl/fsl_easrc.c b/sound/soc/fsl/fsl_easrc.c > index 5d715bc07357..ae0fbf6c316b 100644 > --- a/sound/soc/fsl/fsl_easrc.c > +++ b/sound/soc/fsl/fsl_easrc.c > @@ -1347,6 +1347,10 @@ static void fsl_easrc_release_context(struct > fsl_asrc_pair *ctx) > > guard(spinlock_irqsave)(&easrc->lock); > > + /* Nothing to release if the context is not owned by @ctx */ > + if (easrc->pair[ctx->index] != ctx) > + return; > + > fsl_easrc_release_slot(easrc, ctx->index); > > easrc->channel_avail += ctx->channels; > @@ -1500,6 +1504,12 @@ static int fsl_easrc_hw_params(struct > snd_pcm_substream *substream, > snd_pcm_format_t format = params_format(params); > int ret; > > + /* hw_params() may be called again without hw_free() in between */ > + if (ctx_priv->ctx_streams & BIT(substream->stream)) { > + ctx_priv->ctx_streams &= ~BIT(substream->stream); > + fsl_easrc_release_context(ctx); > + } > + > ret = fsl_easrc_request_context(channels, ctx); > if (ret) { > dev_err(dev, "failed to request context\n"); > -- > 2.53.0 >
