diff options
| author | Zidan Wang <zidan.wang@freescale.com> | 2015-11-27 13:50:12 +0800 |
|---|---|---|
| committer | Nitin Garg <nitin.garg@nxp.com> | 2016-01-14 11:02:29 -0600 |
| commit | d502b044778fe66a3b85d7a33a255b97b8e21969 (patch) | |
| tree | 10a2d44d9f9c1ce734db720d5f04d43336e03282 /sound | |
| parent | c9d480c5f4f52834e61dc075c2fc894907d5d0ef (diff) | |
MLK-11915-12 ASoC: fsl_asrc_m2m: fix null check issue for variable m2m and pair
After allocating memory for m2m, we should null check for m2m instead of pair.
In fsl_asrc_close(), null-checking pair suggests that it may be null, but it
has already been dereferenced before the null check. pair will be alloceted
in fsl_asrc_open(), pair is null means that open dev file failed, and
close should not be called in user space. So remove null check for pair.
buf_len should not greater than ASRC_DMA_BUFFER_SIZE, otherwith dma buffer will
be overrun.
Reported by Coverity.
Signed-off-by: Zidan Wang <zidan.wang@freescale.com>
(cherry picked from commit b0dc15375b12b6c1bf46b9071b92267b827d8ce0)
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/fsl/fsl_asrc_m2m.c | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/sound/soc/fsl/fsl_asrc_m2m.c b/sound/soc/fsl/fsl_asrc_m2m.c index a7defb59bfcf..8de37d46940d 100644 --- a/sound/soc/fsl/fsl_asrc_m2m.c +++ b/sound/soc/fsl/fsl_asrc_m2m.c @@ -273,8 +273,9 @@ static int fsl_asrc_prepare_io_buffer(struct fsl_asrc_pair *pair, else word_size = 2; - if (buf_len < word_size * pair->channels * wm) { - pair_err("%sput buffer size is too small: [%d]\n", + if (buf_len < word_size * pair->channels * wm || + buf_len > ASRC_DMA_BUFFER_SIZE) { + pair_err("%sput buffer size is error: [%d]\n", DIR_STR(dir), buf_len); return -EINVAL; } @@ -824,7 +825,7 @@ static int fsl_asrc_open(struct inode *inode, struct file *file) } m2m = kzalloc(sizeof(struct fsl_asrc_m2m), GFP_KERNEL); - if (!pair) { + if (!m2m) { dev_err(dev, "failed to allocate m2m resource\n"); return -ENOMEM; } @@ -853,9 +854,6 @@ static int fsl_asrc_close(struct inode *inode, struct file *file) unsigned long lock_flags; int i; - if (!pair) - goto out; - /* Make sure we have clear the pointer */ spin_lock_irqsave(&asrc_priv->lock, lock_flags); for (i = 0; i < ASRC_PAIR_MAX_NUM; i++) @@ -897,7 +895,6 @@ static int fsl_asrc_close(struct inode *inode, struct file *file) spin_unlock_irqrestore(&asrc_priv->lock, lock_flags); file->private_data = NULL; -out: pm_runtime_put_sync(dev); return 0; |