diff options
| author | Jesper Juhl <jj@chaosbits.net> | 2010-10-29 21:35:25 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2010-11-02 07:38:21 +0100 |
| commit | fd0977d0f42d3e73121b88f57c7d48ca9b861a58 (patch) | |
| tree | 6a851561a7a67d660f5ce5260f6e6429fed0eccc /sound/pci/asihpi/hpi6205.c | |
| parent | f7467452291f7c9e5e1271e8c8e45b77f34b1257 (diff) | |
ALSA: asihpi - Unsafe memory management when allocating control cache
I noticed that sound/pci/asihpi/hpicmn.c::hpi_alloc_control_cache() does
not check the return value from kmalloc(), which may fail.
If kmalloc() fails we'll dereference a null pointer and things will go bad
fast.
There are two memory allocations in that function and there's also the
problem that the first may succeed and the second may fail and nothing is
done about that either which will also go wrong down the line.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Eliot Blennerhassett <linux@audioscience.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/pci/asihpi/hpi6205.c')
| -rw-r--r-- | sound/pci/asihpi/hpi6205.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/pci/asihpi/hpi6205.c b/sound/pci/asihpi/hpi6205.c index 22c5fc625533..2672f6591ceb 100644 --- a/sound/pci/asihpi/hpi6205.c +++ b/sound/pci/asihpi/hpi6205.c @@ -644,6 +644,8 @@ static u16 create_adapter_obj(struct hpi_adapter_obj *pao, interface->control_cache.size_in_bytes, (struct hpi_control_cache_info *) p_control_cache_virtual); + if (!phw->p_cache) + err = HPI_ERROR_MEMORY_ALLOC; } if (!err) { err = hpios_locked_mem_get_phys_addr(&phw-> |