mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-12 21:57:43 +00:00
Code Issues Releases Wiki Activity

greybus: audio: Add check for invalid index while mapping control

Browse source 
While mapping control id to define DAPM routes, invalid control index
may cause kernel oops. Add extra check to validate index while mapping
names to control_id.

Signed-off-by: Vaibhav Agarwal <vaibhav.agarwal@linaro.org>
Reviewed-by: Mark Greer <mgreer@animalcreek.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Vaibhav Agarwal 2016-08-16 12:36:50 +05:30 committed by Greg Kroah-Hartman
parent 0900845ab7
commit 15c726ea52
2 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
drivers/staging/greybus/audio_codec.h
View file

@ -132,6 +132,7 @@ struct gbaudio_control {
char *name;
char *wname;
const char * const *texts;
int items;
struct list_head list;
};

6
drivers/staging/greybus/audio_topology.c
View file

@ -64,6 +64,8 @@ static const char *gbaudio_map_controlid(struct gbaudio_module_info *module,
if (control->id == control_id) {
if (index == GBAUDIO_INVALID_ID)
return control->name;
if (index >= control->items)
return NULL;
return control->texts[index];
}
}
@ -71,6 +73,8 @@ static const char *gbaudio_map_controlid(struct gbaudio_module_info *module,
if (control->id == control_id) {
if (index == GBAUDIO_INVALID_ID)
return control->name;
if (index >= control->items)
return NULL;
return control->texts[index];
}
}
@ -1038,6 +1042,7 @@ static int gbaudio_tplg_create_widget(struct gbaudio_module_info *module,
csize += gbenum->names_length;
control->texts = (const char * const *)
gb_generate_enum_strings(module, gbenum);
control->items = gbenum->items;
} else
csize = sizeof(struct gb_audio_control);
*w_size += csize;
@ -1184,6 +1189,7 @@ static int gbaudio_tplg_process_kcontrols(struct gbaudio_module_info *module,
csize += gbenum->names_length;
control->texts = (const char * const *)
gb_generate_enum_strings(module, gbenum);
control->items = gbenum->items;
} else
csize = sizeof(struct gb_audio_control);