Message-ID: <sashiko-outbox-202212@kernel.org>
From: sashiko-bot@kernel.org
Subject: Re: [PATCH 2/4] ASoC: fsl: asrc: Use dmaengine API instead of
 chan->device->dev
Reply-To: sashiko-reviews@lists.linux.dev
To: Frank.Li@oss.nxp.com
Cc: linux-sound@vger.kernel.org, imx@lists.linux.dev, Frank.Li@kernel.org, wsa+renesas@sang-engineering.com
In-Reply-To: <20261106-dma_sound_cleanup-v1-2-5eb8a7b81e87@nxp.com>
References: <20261106-dma_sound_cleanup-v1-0-5eb8a7b81e87@nxp.com>
 <20261106-dma_sound_cleanup-v1-2-5eb8a7b81e87@nxp.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Fri, 06 Nov 2026 20:29:13 +0000
Precedence: list

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] ASoC: fsl_asrc_dma: ERR_PTR dereference in
  fsl_asrc_dma_hw_params() [1]
--

commit 5ed216d0bcbc0b97f113bf28f5e8a475ae506081
Author: Frank Li <Frank.Li@nxp.com>

ASoC: fsl: asrc: Use dmaengine API instead of chan->device->dev

This commit replaces direct accesses to chan->device->dev with
dmaengine_get_dma_device() and dmaengine_get_provider_device() in the
Freescale ASRC DMA driver.

> diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c
> index b417de6abebe4..12c3f19a431a8 100644
> --- a/sound/soc/fsl/fsl_asrc_dma.c
> +++ b/sound/soc/fsl/fsl_asrc_dma.c
> @@ -262,7 +262,7 @@ static int fsl_asrc_dma_hw_params(struct snd_soc_comp=
onent *component,
>  		pair->dma_data.priority =3D tmp_data->priority;
>  		dma_release_channel(tmp_chan);
> =20
> -		of_dma_node =3D pair->dma_chan[!dir]->device->dev->of_node;
> +		of_dma_node =3D dmaengine_get_provider_device(pair->dma_chan[!dir])->o=
f_node;
>  		pair->dma_chan[dir] =3D
>  			__dma_request_channel(&mask, filter, &pair->dma_data,
>  					      of_dma_node);

[Severity: Critical]
This problem wasn't introduced by this patch, but can tmp_chan->private
dereference an error pointer [1] just above this hunk?

asrc->get_dma_channel() returns an ERR_PTR from dma_request_chan() when
front-end DMA channel allocation fails, whereas fsl_asrc_dma_hw_params()
only checks for !tmp_chan before accessing tmp_chan->private:

sound/soc/fsl/fsl_asrc_dma.c:fsl_asrc_dma_hw_params() {
	...
		tmp_chan =3D asrc->get_dma_channel(pair, dir);
		if (!tmp_chan) {
			dma_release_channel(pair->dma_chan[!dir]);
			pair->dma_chan[!dir] =3D NULL;
			return -EINVAL;
		}
		tmp_data =3D tmp_chan->private;
	...
}

Should this check IS_ERR_OR_NULL(tmp_chan) instead?

[1] https://sashiko.dev/#/bug/linux-564b9a37-0988-4e75-909c-eb977f811fd1

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261106-dma_sound_=
cleanup-v1-0-5eb8a7b81e87@nxp.com?part=3D2