Subject: [PATCH v2] media: saa7134-alsa: avoid IRQ handling before capture is prepared

Hello Greg and maintainers,

I apologize for the mistake in my previous submission. I sent the updated
patch directly to Greg as an attachment, but I did not post it to the
linux-media mailing list. Therefore, there is no lore.kernel.org link for
that submission.

The patch fixes a potential NULL pointer dereference in the saa7134 ALSA
IRQ path. If the ALSA capture stream has not been successfully prepared,
dev->dmasound.substream may be NULL when a DMA sound interrupt is handled.
The handler can then call snd_pcm_stop_xrun() with a NULL substream and
crash the kernel in IRQ context.

The patch ignores DMA sound interrupts until the ALSA substream and the
required buffer parameters have been initialized.

The v2 patch was previously tested on a clean tree at commit
6779b50faa56 with:

  git am --3way 0001-media-saa7134-alsa-avoid-IRQ-handling-before-capture.patch
  ./scripts/checkpatch.pl --strict 0001-media-saa7134-alsa-avoid-IRQ-handling-before-capture.patch
  make M=drivers/media/pci/saa7134 modules

The patch applied successfully, checkpatch reported zero errors and zero
warnings, and the saa7134 module build succeeded.

Could you please review this patch and let me know whether an updated
version is required? I would also appreciate guidance on whether this issue
is confirmed as a security bug and whether a CVE should be requested.

Regards,

Yuhang Pan
[email protected]


======================================================================
Inline patch
======================================================================

From e8dc7af05c562822c687beae88582e78aef205f6 Mon Sep 17 00:00:00 2001
From: Pan Yuhang <[email protected]>
Date: Mon, 25 May 2026 13:45:39 +0800
Subject: [PATCH v2] media: saa7134-alsa: avoid IRQ handling before capture is
 prepared

The saa7134 ALSA IRQ handler can be reached while the ALSA PCM capture
stream has not been prepared. In that state, dmasound.substream can be
NULL and the dmasound buffer parameters can still be zero.

If a DMA sound interrupt is handled in that state,
saa7134_irq_alsa_done() can reach the overrun path and call
snd_pcm_stop_xrun() with a NULL substream pointer, causing a NULL pointer
dereference in IRQ context and a kernel panic.

The same handler also uses blocks and blksize for ring-buffer processing,
so those fields must be initialized before the IRQ path continues.

Ignore DMA sound interrupts unless the ALSA substream and buffer
parameters have been initialized.

Signed-off-by: Pan Yuhang <[email protected]>
---
 drivers/media/pci/saa7134/saa7134-alsa.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
index 147985bb0261..eab0843c4eba 100644
--- a/drivers/media/pci/saa7134/saa7134-alsa.c
+++ b/drivers/media/pci/saa7134/saa7134-alsa.c
@@ -126,6 +126,11 @@ static void saa7134_irq_alsa_done(struct saa7134_dev *dev,
     int next_blk, reg = 0;
 
     spin_lock(&dev->slock);
+    if (!dev->dmasound.substream || !dev->dmasound.blocks ||
+        !dev->dmasound.blksize) {
+        pr_debug("irq: recording not active\n");
+        goto done;
+    }
     if (UNSET == dev->dmasound.dma_blk) {
         pr_debug("irq: recording stopped\n");
         goto done;
-- 
2.34.1

From e8dc7af05c562822c687beae88582e78aef205f6 Mon Sep 17 00:00:00 2001
From: Pan Yuhang <[email protected]>
Date: Mon, 25 May 2026 13:45:39 +0800
Subject: [PATCH v2] media: saa7134-alsa: avoid IRQ handling before capture is
 prepared

The saa7134 ALSA IRQ handler can be reached while the ALSA PCM capture
stream has not been prepared. In that state, dmasound.substream can be
NULL and the dmasound buffer parameters can still be zero.

If a DMA sound interrupt is handled in that state,
saa7134_irq_alsa_done() can reach the overrun path and call
snd_pcm_stop_xrun() with a NULL substream pointer, causing a NULL pointer
dereference in IRQ context and a kernel panic.

The same handler also uses blocks and blksize for ring-buffer processing,
so those fields must be initialized before the IRQ path continues.

Ignore DMA sound interrupts unless the ALSA substream and buffer
parameters have been initialized.

Signed-off-by: Pan Yuhang <[email protected]>
---
 drivers/media/pci/saa7134/saa7134-alsa.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
index 147985bb0261..eab0843c4eba 100644
--- a/drivers/media/pci/saa7134/saa7134-alsa.c
+++ b/drivers/media/pci/saa7134/saa7134-alsa.c
@@ -126,6 +126,11 @@ static void saa7134_irq_alsa_done(struct saa7134_dev *dev,
 	int next_blk, reg = 0;
 
 	spin_lock(&dev->slock);
+	if (!dev->dmasound.substream || !dev->dmasound.blocks ||
+	    !dev->dmasound.blksize) {
+		pr_debug("irq: recording not active\n");
+		goto done;
+	}
 	if (UNSET == dev->dmasound.dma_blk) {
 		pr_debug("irq: recording stopped\n");
 		goto done;
-- 
2.34.1