Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 931f27c6 authored by Xiubo Li's avatar Xiubo Li Committed by Mark Brown
Browse files

ASoC: cache: Do the codec->reg_cache zero pionter check 



For the snd_soc_cache_init(), the reg_size maybe zero and then the value
of codec->reg_cache, which is alloced via kzalloc, maybe equal to
ZERO_SIZE_PTR. If the reg parameter of snd_soc_cache_write() is large enough,
the cache[idx] = val maybe cause the kernel crash...

So this patch fix this via doing the zero pionter check of it.

Signed-off-by: default avatarXiubo Li <Li.Xiubo@freescale.com>
Signed-off-by: default avatarMark Brown <broonie@linaro.org>
parent 939d9f16

sound/soc/soc-cache.c

+7 −6
Original line number Diff line number Diff line
@@ -96,8 +96,7 @@ int snd_soc_cache_exit(struct snd_soc_codec *codec) 
{

	dev_dbg(codec->dev, "ASoC: Destroying cache for %s codec\n",

			codec->name);

	if (!codec->reg_cache)

		return 0;



	kfree(codec->reg_cache);

	codec->reg_cache = NULL;

	return 0;
@@ -117,6 +116,7 @@ int snd_soc_cache_read(struct snd_soc_codec *codec, 
		return -EINVAL;



	mutex_lock(&codec->cache_rw_mutex);

	if (!ZERO_OR_NULL_PTR(codec->reg_cache))

		*value = snd_soc_get_cache_val(codec->reg_cache, reg,

					       codec->driver->reg_word_size);

	mutex_unlock(&codec->cache_rw_mutex);
@@ -136,6 +136,7 @@ int snd_soc_cache_write(struct snd_soc_codec *codec, 
			unsigned int reg, unsigned int value)

{

	mutex_lock(&codec->cache_rw_mutex);

	if (!ZERO_OR_NULL_PTR(codec->reg_cache))

		snd_soc_set_cache_val(codec->reg_cache, reg, value,

				      codec->driver->reg_word_size);

	mutex_unlock(&codec->cache_rw_mutex);