diff options
| author | Liam Girdwood <liam.r.girdwood@linux.intel.com> | 2018-03-14 20:42:40 +0000 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2018-03-19 15:12:54 +0800 |
| commit | 05bdcf12905533b8628627b6634608cd3b57c607 (patch) | |
| tree | 65c984ba3432cf16ae511dd9dae9191acaf47c6e /sound/soc/soc-topology.c | |
| parent | bde8b3887add8368ecf0ca71117baf2fd56a6fc9 (diff) | |
ASoC: topology: Check widget kcontrols before deref.
Validate the topology input before we dereference the pointer.
Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound/soc/soc-topology.c')
| -rw-r--r-- | sound/soc/soc-topology.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c index e81b52600d58..b363f2409f72 100644 --- a/sound/soc/soc-topology.c +++ b/sound/soc/soc-topology.c @@ -504,6 +504,9 @@ static void remove_widget(struct snd_soc_component *comp, if (dobj->ops && dobj->ops->widget_unload) dobj->ops->widget_unload(comp, dobj); + if (!w->kcontrols) + goto free_news; + /* * Dynamic Widgets either have 1..N enum kcontrols or mixers. * The enum may either have an array of values or strings. @@ -524,7 +527,6 @@ static void remove_widget(struct snd_soc_component *comp, kfree(se); } - kfree(w->kcontrol_news); } else { /* volume mixer or bytes controls */ for (i = 0; i < w->num_kcontrols; i++) { @@ -541,8 +543,11 @@ static void remove_widget(struct snd_soc_component *comp, kfree((void *)kcontrol->private_value); snd_ctl_remove(card, kcontrol); } - kfree(w->kcontrol_news); } + +free_news: + kfree(w->kcontrol_news); + /* widget w is freed by soc-dapm.c */ } |