Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-08 05:01:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

ASoC: dapm: Fix kcontrol path list corruption

Browse Source 
When calling krealloc for the kcontrol data the items in the path list that
point back to the head of the list will now point to freed memory, which causes
the list to become corrupted. To fix this, instead of resizing the whole data
struct, only resize the widget list.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
This commit is contained in:
Lars-Peter Clausen 2013-08-01 14:08:07 +02:00 committed by Mark Brown
parent 9356e9d51c
commit 2c75bdf3fd
1 changed files with 21 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
sound/soc/soc-dapm.c
View File

@ -177,7 +177,7 @@ static inline struct snd_soc_dapm_widget *dapm_cnew_widget(
struct dapm_kcontrol_data {
unsigned int value;
struct list_head paths;
struct snd_soc_dapm_widget_list wlist;
struct snd_soc_dapm_widget_list *wlist;
};
static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
@ -185,7 +185,7 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
{
struct dapm_kcontrol_data *data;
data = kzalloc(sizeof(*data) + sizeof(widget), GFP_KERNEL);
data = kzalloc(sizeof(*data), GFP_KERNEL);
if (!data) {
dev_err(widget->dapm->dev,
"ASoC: can't allocate kcontrol data for %s\n",
@ -193,8 +193,6 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
return -ENOMEM;
}
data->wlist.widgets[0] = widget;
data->wlist.num_widgets = 1;
INIT_LIST_HEAD(&data->paths);
kcontrol->private_data = data;
@ -205,6 +203,7 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
static void dapm_kcontrol_free(struct snd_kcontrol *kctl)
{
struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl);
kfree(data->wlist);
kfree(data);
}
@ -213,25 +212,30 @@ static struct snd_soc_dapm_widget_list *dapm_kcontrol_get_wlist(
{
struct dapm_kcontrol_data *data = snd_kcontrol_chip(kcontrol);
return &data->wlist;
return data->wlist;
}
static int dapm_kcontrol_add_widget(struct snd_kcontrol *kcontrol,
struct snd_soc_dapm_widget *widget)
{
struct dapm_kcontrol_data *data = snd_kcontrol_chip(kcontrol);
struct dapm_kcontrol_data *new_data;
unsigned int n = data->wlist.num_widgets + 1;
struct snd_soc_dapm_widget_list *new_wlist;
unsigned int n;
new_data = krealloc(data, sizeof(*data) + sizeof(widget) * n,
GFP_KERNEL);
if (!new_data)
if (data->wlist)
n = data->wlist->num_widgets + 1;
else
n = 1;
new_wlist = krealloc(data->wlist,
sizeof(*new_wlist) + sizeof(widget) * n, GFP_KERNEL);
if (!new_wlist)
return -ENOMEM;
new_data->wlist.widgets[n - 1] = widget;
new_data->wlist.num_widgets = n;
new_wlist->widgets[n - 1] = widget;
new_wlist->num_widgets = n;
kcontrol->private_data = new_data;
data->wlist = new_wlist;
return 0;
}
@ -689,12 +693,12 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w,
w->name, name, ret);
return ret;
}
} else {
ret = dapm_kcontrol_add_widget(kcontrol, w);
if (ret)
return ret;
}
ret = dapm_kcontrol_add_widget(kcontrol, w);
if (ret)
return ret;
w->kcontrols[kci] = kcontrol;
dapm_kcontrol_add_path(kcontrol, path);