Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f5e2199a authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: bcm2835-audio: allocate enough data for work queues 



We accidentally allocate sizeof(void *) bytes instead of 112 bytes.  It
results in memory corruption.

Fixes: 23b028c8 ("staging: bcm2835-audio: initial staging submission")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 021fbaa5

drivers/staging/bcm2835-audio/bcm2835-vchiq.c

+9 −6
Original line number Diff line number Diff line
@@ -135,8 +135,9 @@ int bcm2835_audio_start(struct bcm2835_alsa_stream *alsa_stream) 


	LOG_DBG(" .. IN\n");

	if (alsa_stream->my_wq) {

		struct bcm2835_audio_work *work =

			kmalloc(sizeof(struct bcm2835_audio_work *), GFP_ATOMIC);

		struct bcm2835_audio_work *work;



		work = kmalloc(sizeof(*work), GFP_ATOMIC);

		/*--- Queue some work (item 1) ---*/

		if (work) {

			INIT_WORK(&work->my_work, my_wq_function);
@@ -157,8 +158,9 @@ int bcm2835_audio_stop(struct bcm2835_alsa_stream *alsa_stream) 


	LOG_DBG(" .. IN\n");

	if (alsa_stream->my_wq) {

		struct bcm2835_audio_work *work =

			kmalloc(sizeof(struct bcm2835_audio_work *), GFP_ATOMIC);

		struct bcm2835_audio_work *work;



		work = kmalloc(sizeof(*work), GFP_ATOMIC);

		/*--- Queue some work (item 1) ---*/

		if (work) {

			INIT_WORK(&work->my_work, my_wq_function);
@@ -180,8 +182,9 @@ int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream, 


	LOG_DBG(" .. IN\n");

	if (alsa_stream->my_wq) {

		struct bcm2835_audio_work *work =

			kmalloc(sizeof(struct bcm2835_audio_work *), GFP_ATOMIC);

		struct bcm2835_audio_work *work;



		work = kmalloc(sizeof(*work), GFP_ATOMIC);

		/*--- Queue some work (item 1) ---*/

		if (work) {

			INIT_WORK(&work->my_work, my_wq_function);