Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5d05d2b5 authored by Mayank Rana's avatar Mayank Rana Committed by Banajit Goswami
Browse files

msm: usbaudio: Add check for NULL before dereferencing 



kzalloc() and usb_ifnum_to_if() both APIs can return NULL. Current
code is not checking return value and derefencing which may crash
device if it is set to NULL. Fix this by checking return value
against NULL and handling the same.

CRs-Fixed: 562273
Change-Id: I0d2c910f43321e94fc447b19ae3e3207727e24f3
Signed-off-by: default avatarMayank Rana <mrana@codeaurora.org>
Signed-off-by: default avatarBanajit Goswami <bgoswami@codeaurora.org>
parent 567e0aee

sound/usb/card.c

+15 −3
Original line number Original line Diff line number Diff line
@@ -220,11 +220,24 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) 
	struct usb_device *dev = chip->dev;

	struct usb_device *dev = chip->dev;

	struct usb_host_interface *host_iface;

	struct usb_host_interface *host_iface;

	struct usb_interface_descriptor *altsd;

	struct usb_interface_descriptor *altsd;

	struct usb_interface *usb_iface;

	void *control_header;

	void *control_header;

	int i, protocol;

	int i, protocol;





	usb_iface = usb_ifnum_to_if(dev, ctrlif);

	if (!usb_iface) {

		snd_printk(KERN_ERR "%d:%u : does not exist\n",

					dev->devnum, ctrlif);

		return -EINVAL;

	}



	/* find audiocontrol interface */

	/* find audiocontrol interface */

	host_iface = &usb_ifnum_to_if(dev, ctrlif)->altsetting[0];

	host_iface = &usb_iface->altsetting[0];

	if (!host_iface) {

		snd_printk(KERN_ERR "Audio Control interface is not available.");

		return -EINVAL;

	}



	control_header = snd_usb_find_csint_desc(host_iface->extra,

	control_header = snd_usb_find_csint_desc(host_iface->extra,

						 host_iface->extralen,

						 host_iface->extralen,

						 NULL, UAC_HEADER);

						 NULL, UAC_HEADER);
@@ -264,8 +277,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) 




	case UAC_VERSION_2: {

	case UAC_VERSION_2: {

		struct usb_interface_assoc_descriptor *assoc =

		struct usb_interface_assoc_descriptor *assoc =

			usb_ifnum_to_if(dev, ctrlif)->intf_assoc;

						usb_iface->intf_assoc;



		if (!assoc) {

		if (!assoc) {

			/*

			/*

			 * Firmware writers cannot count to three.  So to find

			 * Firmware writers cannot count to three.  So to find