diff options
| author | Thierry Reding <treding@nvidia.com> | 2021-04-16 10:11:46 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2021-04-16 18:54:08 +0300 |
| commit | 0f687d826736a5b4eee03170382fe54d413b912a (patch) | |
| tree | b9381d1f457f60c24daeb8f79121bef22fe53869 /sound/soc/generic/simple-card.c | |
| parent | d97140033948363ffdf5ed71dd2366f717e120e7 (diff) | |
| download | linux-0f687d826736a5b4eee03170382fe54d413b912a.tar.xz | |
ASoC: simple-card-utils: Propagate errors on too many links
The DAI counting code doesn't propagate errors when the number of
maximum links is exceeded, which causes subsequent initialization code
to continue to run and that eventually leads to memory corruption with
the code trying to access memory that is out of bounds.
Fix this by propagating errors when the maximum number of links is
reached, which ensures that the driver fails to load and prevents the
memory corruption.
Fixes: f2138aed231c ("ASoC: simple-card-utils: enable flexible CPU/Codec/Platform")
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20210416071147.2149109-1-thierry.reding@gmail.com
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound/soc/generic/simple-card.c')
| -rw-r--r-- | sound/soc/generic/simple-card.c | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c index 5a686f82d1b4..e05539b5f997 100644 --- a/sound/soc/generic/simple-card.c +++ b/sound/soc/generic/simple-card.c @@ -524,8 +524,8 @@ static int simple_count_dpcm(struct asoc_simple_priv *priv, return 0; } -static void simple_get_dais_count(struct asoc_simple_priv *priv, - struct link_info *li) +static int simple_get_dais_count(struct asoc_simple_priv *priv, + struct link_info *li) { struct device *dev = simple_priv_to_dev(priv); struct device_node *top = dev->of_node; @@ -582,12 +582,12 @@ static void simple_get_dais_count(struct asoc_simple_priv *priv, li->num[0].platforms = 1; li->link = 1; - return; + return 0; } - simple_for_each_link(priv, li, - simple_count_noml, - simple_count_dpcm); + return simple_for_each_link(priv, li, + simple_count_noml, + simple_count_dpcm); } static int simple_soc_probe(struct snd_soc_card *card) @@ -626,7 +626,10 @@ static int asoc_simple_probe(struct platform_device *pdev) card->probe = simple_soc_probe; memset(&li, 0, sizeof(li)); - simple_get_dais_count(priv, &li); + ret = simple_get_dais_count(priv, &li); + if (ret < 0) + return ret; + if (!li.link) return -EINVAL; |