Commit 931f27c6 authored by Xiubo Li's avatar Xiubo Li Committed by Mark Brown

ASoC: cache: Do the codec->reg_cache zero pionter check

For the snd_soc_cache_init(), the reg_size maybe zero and then the value
of codec->reg_cache, which is alloced via kzalloc, maybe equal to
ZERO_SIZE_PTR. If the reg parameter of snd_soc_cache_write() is large enough,
the cache[idx] = val maybe cause the kernel crash...

So this patch fix this via doing the zero pionter check of it.
Signed-off-by: default avatarXiubo Li <Li.Xiubo@freescale.com>
Signed-off-by: default avatarMark Brown <broonie@linaro.org>
parent 939d9f16
...@@ -96,8 +96,7 @@ int snd_soc_cache_exit(struct snd_soc_codec *codec) ...@@ -96,8 +96,7 @@ int snd_soc_cache_exit(struct snd_soc_codec *codec)
{ {
dev_dbg(codec->dev, "ASoC: Destroying cache for %s codec\n", dev_dbg(codec->dev, "ASoC: Destroying cache for %s codec\n",
codec->name); codec->name);
if (!codec->reg_cache)
return 0;
kfree(codec->reg_cache); kfree(codec->reg_cache);
codec->reg_cache = NULL; codec->reg_cache = NULL;
return 0; return 0;
...@@ -117,8 +116,9 @@ int snd_soc_cache_read(struct snd_soc_codec *codec, ...@@ -117,8 +116,9 @@ int snd_soc_cache_read(struct snd_soc_codec *codec,
return -EINVAL; return -EINVAL;
mutex_lock(&codec->cache_rw_mutex); mutex_lock(&codec->cache_rw_mutex);
*value = snd_soc_get_cache_val(codec->reg_cache, reg, if (!ZERO_OR_NULL_PTR(codec->reg_cache))
codec->driver->reg_word_size); *value = snd_soc_get_cache_val(codec->reg_cache, reg,
codec->driver->reg_word_size);
mutex_unlock(&codec->cache_rw_mutex); mutex_unlock(&codec->cache_rw_mutex);
return 0; return 0;
...@@ -136,8 +136,9 @@ int snd_soc_cache_write(struct snd_soc_codec *codec, ...@@ -136,8 +136,9 @@ int snd_soc_cache_write(struct snd_soc_codec *codec,
unsigned int reg, unsigned int value) unsigned int reg, unsigned int value)
{ {
mutex_lock(&codec->cache_rw_mutex); mutex_lock(&codec->cache_rw_mutex);
snd_soc_set_cache_val(codec->reg_cache, reg, value, if (!ZERO_OR_NULL_PTR(codec->reg_cache))
codec->driver->reg_word_size); snd_soc_set_cache_val(codec->reg_cache, reg, value,
codec->driver->reg_word_size);
mutex_unlock(&codec->cache_rw_mutex); mutex_unlock(&codec->cache_rw_mutex);
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment