diff options
| author | Vaibhav Agarwal <vaibhav.agarwal@linaro.org> | 2016-08-16 12:36:50 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@google.com> | 2016-08-18 17:32:39 +0200 |
| commit | 15c726ea5218b4e40d2331bd8b25b85848f73c42 (patch) | |
| tree | 8b73b419b424ec82b413ba4e74523e22b878c711 /drivers/staging/greybus/audio_topology.c | |
| parent | 0900845ab741dd7b0b8b3f03ded0ffc6a348dd90 (diff) | |
greybus: audio: Add check for invalid index while mapping control
While mapping control id to define DAPM routes, invalid control index
may cause kernel oops. Add extra check to validate index while mapping
names to control_id.
Signed-off-by: Vaibhav Agarwal <vaibhav.agarwal@linaro.org>
Reviewed-by: Mark Greer <mgreer@animalcreek.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Diffstat (limited to 'drivers/staging/greybus/audio_topology.c')
| -rw-r--r-- | drivers/staging/greybus/audio_topology.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/staging/greybus/audio_topology.c b/drivers/staging/greybus/audio_topology.c index 937529653cd3..5c5b813b75d3 100644 --- a/drivers/staging/greybus/audio_topology.c +++ b/drivers/staging/greybus/audio_topology.c @@ -64,6 +64,8 @@ static const char *gbaudio_map_controlid(struct gbaudio_module_info *module, if (control->id == control_id) { if (index == GBAUDIO_INVALID_ID) return control->name; + if (index >= control->items) + return NULL; return control->texts[index]; } } @@ -71,6 +73,8 @@ static const char *gbaudio_map_controlid(struct gbaudio_module_info *module, if (control->id == control_id) { if (index == GBAUDIO_INVALID_ID) return control->name; + if (index >= control->items) + return NULL; return control->texts[index]; } } @@ -1038,6 +1042,7 @@ static int gbaudio_tplg_create_widget(struct gbaudio_module_info *module, csize += gbenum->names_length; control->texts = (const char * const *) gb_generate_enum_strings(module, gbenum); + control->items = gbenum->items; } else csize = sizeof(struct gb_audio_control); *w_size += csize; @@ -1184,6 +1189,7 @@ static int gbaudio_tplg_process_kcontrols(struct gbaudio_module_info *module, csize += gbenum->names_length; control->texts = (const char * const *) gb_generate_enum_strings(module, gbenum); + control->items = gbenum->items; } else csize = sizeof(struct gb_audio_control); |