Skip to contentSkip to conversation

ASoC: rockchip: Allocate enough memory so we don't overflow routes

PATCH In review Douglas Anderson 2 participants 2 messages Sep 29, 2017 – Oct 4, 2017

Subsystems (3)
Sound ASoC Arm Rockchip
lore
Share & tools
lore

Douglas Anderson

author
#0 lore raw

PATCH 1/1 ASoC: rockchip: Allocate enough memory so we don't overflow routes

In the recent commit d9f9c167edae ("ASoC: rockchip: Init dapm routes dynamically") we improperly allocated memory for the card->dapm_routes causing us to overflow the allocation on every boot. Oops.

Let's allocate the correct amount of memory. We'll also add a check to make sure that we don't overrun memory even if we encounter some sort of weird device tree.

Fixes d9f9c167edae ("ASoC: rockchip: Init dapm routes dynamically")
Signed-off-by Douglas Anderson <[email protected]>

---

 sound/soc/rockchip/rk3399_gru_sound.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)
sound/soc/rockchip/rk3399_gru_sound.c +11 -1
index 30eed83e8a13..d64fbbd50544 100644
@@ -494,13 +494,17 @@ static int rockchip_sound_of_parse_dais(struct device *dev,
 	struct snd_soc_dai_link *dai;
 	struct snd_soc_dapm_route *routes;
 	int i, index;
+	int num_routes;
 
 	card->dai_link = devm_kzalloc(dev, sizeof(rockchip_dais),
 				      GFP_KERNEL);
 	if (!card->dai_link)
 		return -ENOMEM;
 
-	routes = devm_kzalloc(dev, sizeof(rockchip_routes),
+	num_routes = 0;
+	for (i = 0; i < ARRAY_SIZE(rockchip_routes); i++)
+		num_routes += rockchip_routes[i].num_routes;
+	routes = devm_kzalloc(dev, num_routes * sizeof(*routes),
 			      GFP_KERNEL);
 	if (!routes)
 		return -ENOMEM;

@@ -538,6 +542,12 @@ static int rockchip_sound_of_parse_dais(struct device *dev,
 		dai->platform_of_node = np_cpu;
 		dai->cpu_of_node = np_cpu;
 
+		if (card->num_dapm_routes + rockchip_routes[index].num_routes >
+		    num_routes) {
+			dev_err(dev, "Too many routes\n");
+			return -EINVAL;
+		}
+
 		memcpy(routes + card->num_dapm_routes,
 		       rockchip_routes[index].routes,
 		       rockchip_routes[index].num_routes * sizeof(*routes));
Signature · 1 line
2.14.2.822.g60be5d43e6-goog
maintainer
#1 lore raw

Applied "ASoC: rockchip: Allocate enough memory so we don't overflow routes" to the asoc tree

The patch

ASoC: rockchip: Allocate enough memory so we don't overflow routes

has been applied to the asoc tree at

git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git

All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying to this mail.

Thanks,
Mark

Quoted 1 line

From 8eae6c2585b0455f0e7200495d5e513020ca2fa2 Mon Sep 17 00:00:00 2001

From: Douglas Anderson <[email protected]>
Date: Fri, 29 Sep 2017 15:03:24 -0700
Subject: [PATCH] ASoC: rockchip: Allocate enough memory so we don't overflow
routes

In the recent commit d9f9c167edae ("ASoC: rockchip: Init dapm routes dynamically") we improperly allocated memory for the card->dapm_routes causing us to overflow the allocation on every boot. Oops.

Let's allocate the correct amount of memory. We'll also add a check to make sure that we don't overrun memory even if we encounter some sort of weird device tree.

Fixes d9f9c167edae ("ASoC: rockchip: Init dapm routes dynamically")
Signed-off-by Douglas Anderson <[email protected]>
Signed-off-by Mark Brown <[email protected]>
---
 sound/soc/rockchip/rk3399_gru_sound.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)
sound/soc/rockchip/rk3399_gru_sound.c +11 -1
index 30eed83e8a13..d64fbbd50544 100644
@@ -494,13 +494,17 @@ static int rockchip_sound_of_parse_dais(struct device *dev,
 	struct snd_soc_dai_link *dai;
 	struct snd_soc_dapm_route *routes;
 	int i, index;
+	int num_routes;
 
 	card->dai_link = devm_kzalloc(dev, sizeof(rockchip_dais),
 				      GFP_KERNEL);
 	if (!card->dai_link)
 		return -ENOMEM;
 
-	routes = devm_kzalloc(dev, sizeof(rockchip_routes),
+	num_routes = 0;
+	for (i = 0; i < ARRAY_SIZE(rockchip_routes); i++)
+		num_routes += rockchip_routes[i].num_routes;
+	routes = devm_kzalloc(dev, num_routes * sizeof(*routes),
 			      GFP_KERNEL);
 	if (!routes)
 		return -ENOMEM;

@@ -538,6 +542,12 @@ static int rockchip_sound_of_parse_dais(struct device *dev,
 		dai->platform_of_node = np_cpu;
 		dai->cpu_of_node = np_cpu;
 
+		if (card->num_dapm_routes + rockchip_routes[index].num_routes >
+		    num_routes) {
+			dev_err(dev, "Too many routes\n");
+			return -EINVAL;
+		}
+
 		memcpy(routes + card->num_dapm_routes,
 		       rockchip_routes[index].routes,
 		       rockchip_routes[index].num_routes * sizeof(*routes));
Signature · 1 line
2.14.1