Unverified Commit 9065693d authored Jul 04, 2024 by Kai Vehmanen Committed by Mark Brown Jul 04, 2024

ASoC: SOF: Intel: hda: fix null deref on system suspend entry

When system enters suspend with an active stream, SOF core
calls hw_params_upon_resume(). On Intel platforms with HDA DMA used
to manage the link DMA, this leads to call chain of

   hda_dsp_set_hw_params_upon_resume()
 -> hda_dsp_dais_suspend()
 -> hda_dai_suspend()
 -> hda_ipc4_post_trigger()

A bug is hit in hda_dai_suspend() as hda_link_dma_cleanup() is run first,
which clears hext_stream->link_substream, and then hda_ipc4_post_trigger()
is called with a NULL snd_pcm_substream pointer.

Fixes: 2b009fa0 ("ASoC: SOF: Intel: hda: Unify DAI drv ops for IPC3 and IPC4")
Link: https://github.com/thesofproject/linux/issues/5080


Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://patch.msgid.link/20240704085708.371414-1-pierre-louis.bossart@linux.intel.com


Signed-off-by: Mark Brown <broonie@kernel.org>

parent 2163aff6

sound/soc/sof/intel/hda-dai.c

+6 −6

Original line number	Diff line number	Diff line
		@@ -617,12 +617,6 @@ static int hda_dai_suspend(struct hdac_bus *bus)
		sdai = swidget->private;
		ops = sdai->platform_private;

		ret = hda_link_dma_cleanup(hext_stream->link_substream,
		hext_stream,
		cpu_dai);
		if (ret < 0)
		return ret;

		/* for consistency with TRIGGER_SUSPEND */
		if (ops->post_trigger) {
		ret = ops->post_trigger(sdev, cpu_dai,
		@@ -631,6 +625,12 @@ static int hda_dai_suspend(struct hdac_bus *bus)
		if (ret < 0)
		return ret;
		}

		ret = hda_link_dma_cleanup(hext_stream->link_substream,
		hext_stream,
		cpu_dai);
		if (ret < 0)
		return ret;
		}
		}