* [PATCH] ASoC: cache: Do the codec->reg_cache zero pionter check
@ 2014-02-28 2:48 Xiubo Li
2014-02-28 6:58 ` [alsa-devel] " Lars-Peter Clausen
2014-03-04 4:32 ` Mark Brown
0 siblings, 2 replies; 3+ messages in thread
From: Xiubo Li @ 2014-02-28 2:48 UTC (permalink / raw)
To: broonie, lgirdwood; +Cc: alsa-devel, linux-kernel, perex, tiwai, Xiubo Li
For the snd_soc_cache_init(), the reg_size maybe zero and then the value
of codec->reg_cache, which is alloced via kzalloc, maybe equal to
ZERO_SIZE_PTR. If the reg parameter of snd_soc_cache_write() is large enough,
the cache[idx] = val maybe cause the kernel crash...
So this patch fix this via doing the zero pionter check of it.
Signed-off-by: Xiubo Li <Li.Xiubo@freescale.com>
---
sound/soc/soc-cache.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/sound/soc/soc-cache.c b/sound/soc/soc-cache.c
index 375dc6d..bfed3e4 100644
--- a/sound/soc/soc-cache.c
+++ b/sound/soc/soc-cache.c
@@ -96,8 +96,7 @@ int snd_soc_cache_exit(struct snd_soc_codec *codec)
{
dev_dbg(codec->dev, "ASoC: Destroying cache for %s codec\n",
codec->name);
- if (!codec->reg_cache)
- return 0;
+
kfree(codec->reg_cache);
codec->reg_cache = NULL;
return 0;
@@ -117,8 +116,9 @@ int snd_soc_cache_read(struct snd_soc_codec *codec,
return -EINVAL;
mutex_lock(&codec->cache_rw_mutex);
- *value = snd_soc_get_cache_val(codec->reg_cache, reg,
- codec->driver->reg_word_size);
+ if (!ZERO_OR_NULL_PTR(codec->reg_cache))
+ *value = snd_soc_get_cache_val(codec->reg_cache, reg,
+ codec->driver->reg_word_size);
mutex_unlock(&codec->cache_rw_mutex);
return 0;
@@ -136,8 +136,9 @@ int snd_soc_cache_write(struct snd_soc_codec *codec,
unsigned int reg, unsigned int value)
{
mutex_lock(&codec->cache_rw_mutex);
- snd_soc_set_cache_val(codec->reg_cache, reg, value,
- codec->driver->reg_word_size);
+ if (!ZERO_OR_NULL_PTR(codec->reg_cache))
+ snd_soc_set_cache_val(codec->reg_cache, reg, value,
+ codec->driver->reg_word_size);
mutex_unlock(&codec->cache_rw_mutex);
return 0;
--
1.8.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [alsa-devel] [PATCH] ASoC: cache: Do the codec->reg_cache zero pionter check
2014-02-28 2:48 [PATCH] ASoC: cache: Do the codec->reg_cache zero pionter check Xiubo Li
@ 2014-02-28 6:58 ` Lars-Peter Clausen
2014-03-04 4:32 ` Mark Brown
1 sibling, 0 replies; 3+ messages in thread
From: Lars-Peter Clausen @ 2014-02-28 6:58 UTC (permalink / raw)
To: Xiubo Li; +Cc: broonie, lgirdwood, tiwai, alsa-devel, linux-kernel
On 02/28/2014 03:48 AM, Xiubo Li wrote:
> For the snd_soc_cache_init(), the reg_size maybe zero and then the value
> of codec->reg_cache, which is alloced via kzalloc, maybe equal to
> ZERO_SIZE_PTR. If the reg parameter of snd_soc_cache_write() is large enough,
> the cache[idx] = val maybe cause the kernel crash...
>
There are actually no users of snd_soc_cache_{read,write}() left. Since all
drivers using snd_soc_set_cache_io() are now using native regmap the path in
hw_{read,write} that does call snd_soc_cache_{read,write}() is never hit.
If you want to avoid this theoretical issue just remove the functions.
> So this patch fix this via doing the zero pionter check of it.
>
> Signed-off-by: Xiubo Li <Li.Xiubo@freescale.com>
> ---
> sound/soc/soc-cache.c | 13 +++++++------
> 1 file changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/sound/soc/soc-cache.c b/sound/soc/soc-cache.c
> index 375dc6d..bfed3e4 100644
> --- a/sound/soc/soc-cache.c
> +++ b/sound/soc/soc-cache.c
> @@ -96,8 +96,7 @@ int snd_soc_cache_exit(struct snd_soc_codec *codec)
> {
> dev_dbg(codec->dev, "ASoC: Destroying cache for %s codec\n",
> codec->name);
> - if (!codec->reg_cache)
> - return 0;
> +
> kfree(codec->reg_cache);
> codec->reg_cache = NULL;
> return 0;
> @@ -117,8 +116,9 @@ int snd_soc_cache_read(struct snd_soc_codec *codec,
> return -EINVAL;
>
> mutex_lock(&codec->cache_rw_mutex);
> - *value = snd_soc_get_cache_val(codec->reg_cache, reg,
> - codec->driver->reg_word_size);
> + if (!ZERO_OR_NULL_PTR(codec->reg_cache))
> + *value = snd_soc_get_cache_val(codec->reg_cache, reg,
> + codec->driver->reg_word_size);
> mutex_unlock(&codec->cache_rw_mutex);
>
> return 0;
> @@ -136,8 +136,9 @@ int snd_soc_cache_write(struct snd_soc_codec *codec,
> unsigned int reg, unsigned int value)
> {
> mutex_lock(&codec->cache_rw_mutex);
> - snd_soc_set_cache_val(codec->reg_cache, reg, value,
> - codec->driver->reg_word_size);
> + if (!ZERO_OR_NULL_PTR(codec->reg_cache))
> + snd_soc_set_cache_val(codec->reg_cache, reg, value,
> + codec->driver->reg_word_size);
> mutex_unlock(&codec->cache_rw_mutex);
>
> return 0;
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] ASoC: cache: Do the codec->reg_cache zero pionter check
2014-02-28 2:48 [PATCH] ASoC: cache: Do the codec->reg_cache zero pionter check Xiubo Li
2014-02-28 6:58 ` [alsa-devel] " Lars-Peter Clausen
@ 2014-03-04 4:32 ` Mark Brown
1 sibling, 0 replies; 3+ messages in thread
From: Mark Brown @ 2014-03-04 4:32 UTC (permalink / raw)
To: Xiubo Li; +Cc: lgirdwood, alsa-devel, linux-kernel, perex, tiwai
[-- Attachment #1: Type: text/plain, Size: 354 bytes --]
On Fri, Feb 28, 2014 at 10:48:19AM +0800, Xiubo Li wrote:
> For the snd_soc_cache_init(), the reg_size maybe zero and then the value
> of codec->reg_cache, which is alloced via kzalloc, maybe equal to
> ZERO_SIZE_PTR. If the reg parameter of snd_soc_cache_write() is large enough,
> the cache[idx] = val maybe cause the kernel crash...
Applied, thanks.
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-03-04 4:32 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-02-28 2:48 [PATCH] ASoC: cache: Do the codec->reg_cache zero pionter check Xiubo Li
2014-02-28 6:58 ` [alsa-devel] " Lars-Peter Clausen
2014-03-04 4:32 ` Mark Brown
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).