diff options
author | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2018-06-21 15:37:37 +0200 |
---|---|---|
committer | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2018-06-21 15:37:37 +0200 |
commit | e86ab6530fd4e461ae622b6c1ff72359952a7189 (patch) | |
tree | fb387e644216e47c13da26c5dbecab6822714393 /sound | |
parent | e81dd8a3500fea94ce8786554cbc29bc6b2a9207 (diff) | |
parent | e78bb38b883c42edf81766a1d557aed74458e08f (diff) |
Merge tag 'tegra-l4t-r21.7' into toradex_tk1_l4t_r21.7-next
Merge NVIDIA's latest Linux for Tegra aka L4T R21.7 Linux kernel changes
from git://nv-tegra.nvidia.com/linux-3.10.git commit:
e78bb38b883c42edf81766a1d557aed74458e08f
Conflicts involved missing 24-bit LVDS support and a single whitespace
aka tab difference in drivers/video/tegra/dc/sor.c.
Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
Diffstat (limited to 'sound')
-rw-r--r-- | sound/soc/tegra/tegra30_avp.c | 7 | ||||
-rw-r--r-- | sound/usb/quirks.c | 17 | ||||
-rw-r--r-- | sound/usb/stream.c | 6 |
3 files changed, 20 insertions, 10 deletions
diff --git a/sound/soc/tegra/tegra30_avp.c b/sound/soc/tegra/tegra30_avp.c index 44d954561f96..a074e25614d1 100644 --- a/sound/soc/tegra/tegra30_avp.c +++ b/sound/soc/tegra/tegra30_avp.c @@ -256,7 +256,7 @@ static int tegra30_avp_load_ucode(void) struct audio_engine_data *audio_engine; const struct firmware *ucode_fw; const struct tegra30_avp_ucode_desc *ucode_desc; - int ucode_size = 0, ucode_offset = 0, total_ucode_size = 0; + ssize_t ucode_size = 0, ucode_offset = 0, total_ucode_size = 0; int i, ret = 0; dev_vdbg(audio_avp->dev, "%s", __func__); @@ -296,13 +296,14 @@ static int tegra30_avp_load_ucode(void) } ucode_size = ucode_fw->size; - if (ucode_size <= 0) { + if (ucode_size <= 0 || + ucode_size > avp_ucode_desc[i].max_mem_size) { dev_err(audio_avp->dev, "Invalid ucode size."); ret = -EINVAL; release_firmware(ucode_fw); goto err_param_mem_free; } - dev_vdbg(audio_avp->dev, "%s ucode size = %d bytes", + dev_vdbg(audio_avp->dev, "%s ucode size = %zd bytes", ucode_desc->bin_name, ucode_size); /* Read ucode */ diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index 3879eae7e874..a72bfeee6de2 100644 --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -136,6 +136,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, snd_printk(KERN_ERR "cannot memdup\n"); return -ENOMEM; } + INIT_LIST_HEAD(&fp->list); if (fp->nr_rates > MAX_NR_RATES) { kfree(fp); return -EINVAL; @@ -154,15 +155,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; err = snd_usb_add_audio_stream(chip, stream, fp); if (err < 0) { - kfree(fp); - kfree(rate_table); - return err; + goto error; } if (fp->iface != get_iface_desc(&iface->altsetting[0])->bInterfaceNumber || fp->altset_idx >= iface->num_altsetting) { - kfree(fp); - kfree(rate_table); - return -EINVAL; + err = -EINVAL; + goto error; } alts = &iface->altsetting[fp->altset_idx]; if (fp->datainterval == 0) @@ -173,6 +171,11 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, snd_usb_init_pitch(chip, fp->iface, alts, fp); snd_usb_init_sample_rate(chip, fp->iface, alts, fp, fp->rate_max); return 0; +error: + list_del(&fp->list); /* unlink for avoiding double-free */ + kfree(fp); + kfree(rate_table); + return err; } /* @@ -239,6 +242,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip, fp->ep_attr = get_endpoint(alts, 0)->bmAttributes; fp->datainterval = 0; fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize); + INIT_LIST_HEAD(&fp->list); switch (fp->maxpacksize) { case 0x120: @@ -262,6 +266,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip, ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; err = snd_usb_add_audio_stream(chip, stream, fp); if (err < 0) { + list_del(&fp->list); /* unlink for avoiding double-free */ kfree(fp); return err; } diff --git a/sound/usb/stream.c b/sound/usb/stream.c index 5b6f7a027c6a..7ddf4a437e4a 100644 --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -307,7 +307,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits, /* * add this endpoint to the chip instance. * if a stream with the same endpoint already exists, append to it. - * if not, create a new pcm stream. + * if not, create a new pcm stream. note, fp is added to the substream + * fmt_list and will be freed on the chip instance release. do not free + * fp or do remove it from the substream fmt_list to avoid double-free. */ int snd_usb_add_audio_stream(struct snd_usb_audio *chip, int stream, @@ -755,6 +757,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no); fp->clock = clock; fp->chmap = convert_chmap(num_channels, chconfig, protocol); + INIT_LIST_HEAD(&fp->list); /* some quirks for attributes here */ @@ -799,6 +802,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) snd_printdd(KERN_INFO "%d:%u:%d: add audio endpoint %#x\n", dev->devnum, iface_no, altno, fp->endpoint); err = snd_usb_add_audio_stream(chip, stream, fp); if (err < 0) { + list_del(&fp->list); /* unlink for avoiding double-free */ kfree(fp->rate_table); kfree(fp->chmap); kfree(fp); |