ASoC: rockchip: Allocate enough memory so we don't overflow routes (8eae6c25) · Commits · 戴 / test

In the recent commit ("ASoC: rockchip: Init dapm routes dynamically") we improperly allocated memory for the card->dapm_routes causing us to overflow the allocation on every boot. Oops. Let's allocate the correct amount of memory. We'll also add a check to make sure that we don't overrun memory even if we encounter some sort of weird device tree. Fixes: ("ASoC: rockchip: Init dapm routes dynamically") Signed-off-by:

Douglas Anderson <dianders@chromium.org> Signed-off-by:

Mark Brown <broonie@kernel.org>

sound/soc/rockchip/rk3399_gru_sound.c

+11 −1

Original line number	Diff line number	Diff line
		@@ -494,13 +494,17 @@ static int rockchip_sound_of_parse_dais(struct device *dev,
		struct snd_soc_dai_link *dai;
		struct snd_soc_dapm_route *routes;
		int i, index;
		int num_routes;

		card->dai_link = devm_kzalloc(dev, sizeof(rockchip_dais),
		GFP_KERNEL);
		if (!card->dai_link)
		return -ENOMEM;

		routes = devm_kzalloc(dev, sizeof(rockchip_routes),
		num_routes = 0;
		for (i = 0; i < ARRAY_SIZE(rockchip_routes); i++)
		num_routes += rockchip_routes[i].num_routes;
		routes = devm_kzalloc(dev, num_routes * sizeof(*routes),
		GFP_KERNEL);
		if (!routes)
		return -ENOMEM;
		@@ -538,6 +542,12 @@ static int rockchip_sound_of_parse_dais(struct device *dev,
		dai->platform_of_node = np_cpu;
		dai->cpu_of_node = np_cpu;

		if (card->num_dapm_routes + rockchip_routes[index].num_routes >
		num_routes) {
		dev_err(dev, "Too many routes\n");
		return -EINVAL;
		}

		memcpy(routes + card->num_dapm_routes,
		rockchip_routes[index].routes,
		rockchip_routes[index].num_routes * sizeof(*routes));

Admin message