Unverified Commit 0f687d82 authored by Thierry Reding's avatar Thierry Reding Committed by Mark Brown
Browse files

ASoC: simple-card-utils: Propagate errors on too many links 



The DAI counting code doesn't propagate errors when the number of
maximum links is exceeded, which causes subsequent initialization code
to continue to run and that eventually leads to memory corruption with
the code trying to access memory that is out of bounds.

Fix this by propagating errors when the maximum number of links is
reached, which ensures that the driver fails to load and prevents the
memory corruption.

Fixes: f2138aed ("ASoC: simple-card-utils: enable flexible CPU/Codec/Platform")
Signed-off-by: default avatarThierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20210416071147.2149109-1-thierry.reding@gmail.com


Reviewed-by: default avatarJon Hunter <jonathanh@nvidia.com>
Tested-by: default avatarJon Hunter <jonathanh@nvidia.com>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent d9714003

sound/soc/generic/audio-graph-card.c

+11 −8
Original line number Diff line number Diff line
@@ -542,7 +542,7 @@ static int graph_for_each_link(struct asoc_simple_priv *priv, 
	return ret;

}



static void graph_get_dais_count(struct asoc_simple_priv *priv,

static int graph_get_dais_count(struct asoc_simple_priv *priv,

				struct link_info *li);



int audio_graph_parse_of(struct asoc_simple_priv *priv, struct device *dev)
@@ -555,7 +555,10 @@ int audio_graph_parse_of(struct asoc_simple_priv *priv, struct device *dev) 
	card->dev = dev;



	memset(&li, 0, sizeof(li));

	graph_get_dais_count(priv, &li);

	ret = graph_get_dais_count(priv, &li);

	if (ret < 0)

		return ret;



	if (!li.link)

		return -EINVAL;
@@ -660,7 +663,7 @@ static int graph_count_dpcm(struct asoc_simple_priv *priv, 
	return 0;

}



static void graph_get_dais_count(struct asoc_simple_priv *priv,

static int graph_get_dais_count(struct asoc_simple_priv *priv,

				struct link_info *li)

{

	/*
@@ -709,7 +712,7 @@ static void graph_get_dais_count(struct asoc_simple_priv *priv, 
	 *	=> 4 DAIs  = 2xCPU + 2xCodec

	 *	=> 1 ccnf  = 1xdummy-Codec

	 */

	graph_for_each_link(priv, li,

	return graph_for_each_link(priv, li,

				   graph_count_noml,

				   graph_count_dpcm);

}

sound/soc/generic/simple-card.c

+10 −7
Original line number Diff line number Diff line
@@ -524,7 +524,7 @@ static int simple_count_dpcm(struct asoc_simple_priv *priv, 
	return 0;

}



static void simple_get_dais_count(struct asoc_simple_priv *priv,

static int simple_get_dais_count(struct asoc_simple_priv *priv,

				 struct link_info *li)

{

	struct device *dev = simple_priv_to_dev(priv);
@@ -582,10 +582,10 @@ static void simple_get_dais_count(struct asoc_simple_priv *priv, 
		li->num[0].platforms	= 1;



		li->link = 1;

		return;

		return 0;

	}



	simple_for_each_link(priv, li,

	return simple_for_each_link(priv, li,

				    simple_count_noml,

				    simple_count_dpcm);

}
@@ -626,7 +626,10 @@ static int asoc_simple_probe(struct platform_device *pdev) 
	card->probe		= simple_soc_probe;



	memset(&li, 0, sizeof(li));

	simple_get_dais_count(priv, &li);

	ret = simple_get_dais_count(priv, &li);

	if (ret < 0)

		return ret;



	if (!li.link)

		return -EINVAL;