Unverified Commit 79a2d839 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10404 Fix CVE-2024-41069 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zheng Yejian <zhengyejian1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/T6ZBQ32O3XGEXTA5US2PWC7KNSDLFVQ6/ 
Amadeusz Sławiński (2):
  ASoC: topology: Fix references to freed memory
  ASoC: topology: Fix route memory corruption


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/IAGELE 
 
Link:https://gitee.com/openeuler/kernel/pulls/10404

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents aa5390b9 6bf23b50

sound/soc/soc-topology.c

+14 −5
Original line number Diff line number Diff line
@@ -1258,15 +1258,24 @@ static int soc_tplg_dapm_graph_elems_load(struct soc_tplg *tplg, 
			break;

		}



		routes[i]->source = elem->source;

		routes[i]->sink = elem->sink;

		routes[i]->source = devm_kstrdup(tplg->dev, elem->source, GFP_KERNEL);

		routes[i]->sink = devm_kstrdup(tplg->dev, elem->sink, GFP_KERNEL);

		if (!routes[i]->source || !routes[i]->sink) {

			ret = -ENOMEM;

			break;

		}



		/* set to NULL atm for tplg users */

		routes[i]->connected = NULL;

		if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) == 0)

		if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) == 0) {

			routes[i]->control = NULL;

		else

			routes[i]->control = elem->control;

		} else {

			routes[i]->control = devm_kstrdup(tplg->dev, elem->control, GFP_KERNEL);

			if (!routes[i]->control) {

				ret = -ENOMEM;

				break;

			}

		}



		/* add route dobj to dobj_list */

		routes[i]->dobj.type = SND_SOC_DOBJ_GRAPH;