lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 105/320] staging: greybus: audio: Check null pointer
    Date
    From: Jiasheng Jiang <jiasheng@iscas.ac.cn>

    [ Upstream commit 2e81948177d769106754085c3e03534e6cc1f623 ]

    As the possible alloc failure of devm_kcalloc(), it could return null
    pointer.
    Therefore, 'strings' should be checked and return NULL if alloc fails to
    prevent the dereference of the NULL pointer.
    Also, the caller should also deal with the return value of the
    gb_generate_enum_strings() and return -ENOMEM if returns NULL.
    Moreover, because the memory allocated with devm_kzalloc() will be
    freed automatically when the last reference to the device is dropped,
    the 'gbe' in gbaudio_tplg_create_enum_kctl() and
    gbaudio_tplg_create_enum_ctl() do not need to free manually.
    But the 'control' in gbaudio_tplg_create_widget() and
    gbaudio_tplg_process_kcontrols() has a specially error handle to
    cleanup.
    So it should be better to cleanup 'control' when fails.

    Fixes: e65579e335da ("greybus: audio: topology: Enable enumerated control support")
    Reviewed-by: Alex Elder <elder@linaro.org>
    Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
    Link: https://lore.kernel.org/r/20220104150628.1987906-1-jiasheng@iscas.ac.cn
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/staging/greybus/audio_topology.c | 15 +++++++++++++++
    1 file changed, 15 insertions(+)

    diff --git a/drivers/staging/greybus/audio_topology.c b/drivers/staging/greybus/audio_topology.c
    index a8cfea957868a..3e2fbcd20598a 100644
    --- a/drivers/staging/greybus/audio_topology.c
    +++ b/drivers/staging/greybus/audio_topology.c
    @@ -145,6 +145,9 @@ static const char **gb_generate_enum_strings(struct gbaudio_module_info *gb,

    items = le32_to_cpu(gbenum->items);
    strings = devm_kcalloc(gb->dev, items, sizeof(char *), GFP_KERNEL);
    + if (!strings)
    + return NULL;
    +
    data = gbenum->names;

    for (i = 0; i < items; i++) {
    @@ -662,6 +665,8 @@ static int gbaudio_tplg_create_enum_kctl(struct gbaudio_module_info *gb,
    /* since count=1, and reg is dummy */
    gbe->max = le32_to_cpu(gb_enum->items);
    gbe->texts = gb_generate_enum_strings(gb, gb_enum);
    + if (!gbe->texts)
    + return -ENOMEM;

    /* debug enum info */
    dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max,
    @@ -871,6 +876,8 @@ static int gbaudio_tplg_create_enum_ctl(struct gbaudio_module_info *gb,
    /* since count=1, and reg is dummy */
    gbe->max = le32_to_cpu(gb_enum->items);
    gbe->texts = gb_generate_enum_strings(gb, gb_enum);
    + if (!gbe->texts)
    + return -ENOMEM;

    /* debug enum info */
    dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max,
    @@ -1081,6 +1088,10 @@ static int gbaudio_tplg_create_widget(struct gbaudio_module_info *module,
    csize += le16_to_cpu(gbenum->names_length);
    control->texts = (const char * const *)
    gb_generate_enum_strings(module, gbenum);
    + if (!control->texts) {
    + ret = -ENOMEM;
    + goto error;
    + }
    control->items = le32_to_cpu(gbenum->items);
    } else {
    csize = sizeof(struct gb_audio_control);
    @@ -1190,6 +1201,10 @@ static int gbaudio_tplg_process_kcontrols(struct gbaudio_module_info *module,
    csize += le16_to_cpu(gbenum->names_length);
    control->texts = (const char * const *)
    gb_generate_enum_strings(module, gbenum);
    + if (!control->texts) {
    + ret = -ENOMEM;
    + goto error;
    + }
    control->items = le32_to_cpu(gbenum->items);
    } else {
    csize = sizeof(struct gb_audio_control);
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-24 21:23    [W:5.824 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site