diff options
| author | Xiubo Li <Li.Xiubo@freescale.com> | 2014-02-28 10:48:19 +0800 |
|---|---|---|
| committer | Mark Brown <broonie@linaro.org> | 2014-03-04 12:32:19 +0800 |
| commit | 931f27c6e892fdfe98896055e0df7962e21969d9 (patch) | |
| tree | 0c655c9d5a9f7966560b53ce78427affff51071e /sound/soc/soc-cache.c | |
| parent | 939d9f16994166156fa3d6dfece9c46b92e368e0 (diff) | |
| download | op-kernel-dev-931f27c6e892fdfe98896055e0df7962e21969d9.zip op-kernel-dev-931f27c6e892fdfe98896055e0df7962e21969d9.tar.gz | |
ASoC: cache: Do the codec->reg_cache zero pionter check
For the snd_soc_cache_init(), the reg_size maybe zero and then the value
of codec->reg_cache, which is alloced via kzalloc, maybe equal to
ZERO_SIZE_PTR. If the reg parameter of snd_soc_cache_write() is large enough,
the cache[idx] = val maybe cause the kernel crash...
So this patch fix this via doing the zero pionter check of it.
Signed-off-by: Xiubo Li <Li.Xiubo@freescale.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Diffstat (limited to 'sound/soc/soc-cache.c')
| -rw-r--r-- | sound/soc/soc-cache.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/sound/soc/soc-cache.c b/sound/soc/soc-cache.c index 375dc6d..bfed3e4 100644 --- a/sound/soc/soc-cache.c +++ b/sound/soc/soc-cache.c @@ -96,8 +96,7 @@ int snd_soc_cache_exit(struct snd_soc_codec *codec) { dev_dbg(codec->dev, "ASoC: Destroying cache for %s codec\n", codec->name); - if (!codec->reg_cache) - return 0; + kfree(codec->reg_cache); codec->reg_cache = NULL; return 0; @@ -117,8 +116,9 @@ int snd_soc_cache_read(struct snd_soc_codec *codec, return -EINVAL; mutex_lock(&codec->cache_rw_mutex); - *value = snd_soc_get_cache_val(codec->reg_cache, reg, - codec->driver->reg_word_size); + if (!ZERO_OR_NULL_PTR(codec->reg_cache)) + *value = snd_soc_get_cache_val(codec->reg_cache, reg, + codec->driver->reg_word_size); mutex_unlock(&codec->cache_rw_mutex); return 0; @@ -136,8 +136,9 @@ int snd_soc_cache_write(struct snd_soc_codec *codec, unsigned int reg, unsigned int value) { mutex_lock(&codec->cache_rw_mutex); - snd_soc_set_cache_val(codec->reg_cache, reg, value, - codec->driver->reg_word_size); + if (!ZERO_OR_NULL_PTR(codec->reg_cache)) + snd_soc_set_cache_val(codec->reg_cache, reg, value, + codec->driver->reg_word_size); mutex_unlock(&codec->cache_rw_mutex); return 0; |
