This series fixes memory safety issues in the ASRC and EASRC drivers that can be triggered by a user with access to their PCM or compress devices:
1. fsl_asrc_m2m: the output FIFO drain can write past the end of the output buffer. 2. fsl_asrc: a repeated hw_params() leaves a stale asrc->pair[] entry that points to freed memory after close, and hw_free() after a failed hw_params() can release the pair of another stream. 3. fsl_asrc_dma: DMA channels are leaked on a repeated hw_params(), and released twice after a Back-End configuration error. 4. fsl_easrc: the same repeated hw_params() issue for EASRC contexts. 5. fsl_asrc_m2m: more than one task per compress stream leads to double DMA channel release and a stale pair entry. Patches 2 and 4 make the pair/context release ownership-checked; patch 5 relies on them. Please apply in order. Validated on i.MX8MP (EASRC) and i.MX8QM (ASRC). Changes since v1: - Patch 1: drop the 8-bit output path, ASRC does not support 8-bit output (Shengjiu Wang). - Patches 2-5: add Reviewed-by tags, no code changes. v1: https://lore.kernel.org/linux-sound/[email protected]/T/ Stefan Ghetu (5): ASoC: fsl_asrc_m2m: fix out-of-bounds write when draining the output FIFO ASoC: fsl_asrc: fix pair ownership on repeated or failed hw_params ASoC: fsl_asrc_dma: release DMA channels on repeated hw_params ASoC: fsl_easrc: fix context ownership on repeated hw_params ASoC: fsl_asrc_m2m: allow only one task at a time per stream sound/soc/fsl/fsl_asrc.c | 22 ++++++++++++++++++++++ sound/soc/fsl/fsl_asrc_dma.c | 27 ++++++++++++++++++--------- sound/soc/fsl/fsl_asrc_m2m.c | 30 +++++++++++++++++++----------- sound/soc/fsl/fsl_easrc.c | 10 ++++++++++ 4 files changed, 69 insertions(+), 20 deletions(-) base-commit: b810335a0699d1810683796b0e3ffe8827ddfe6c -- 2.34.1
