ASoC: soc-compress.c: fix NULL dereference (d3268a40) · Commits · 戴 / test

In soc_new_compress() when rtd->dai_link->dynamic is set, we create the pcm substreams with this call: ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num, 1, 0, &be_pcm); which passes 0 as capture_count leading to be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream being NULL, hence when trying to set rtd a few lines below we get an oops. Fix by using rtd->dai_link->dpcm_playback and rtd->dai_link->dpcm_capture as playback_count and capture_count to snd_pcm_new_internal(). Signed-off-by:

Qais Yousef <qais.yousef@imgtec.com> Signed-off-by:

Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org

sound/soc/soc-compress.c

+6 −3

Original line number	Diff line number	Diff line
		@@ -659,7 +659,8 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
		rtd->dai_link->stream_name);

		ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num,
		1, 0, &be_pcm);
		rtd->dai_link->dpcm_playback,
		rtd->dai_link->dpcm_capture, &be_pcm);
		if (ret < 0) {
		dev_err(rtd->card->dev, "ASoC: can't create compressed for %s\n",
		rtd->dai_link->name);
		@@ -668,7 +669,9 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)

		rtd->pcm = be_pcm;
		rtd->fe_compr = 1;
		if (rtd->dai_link->dpcm_playback)
		be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
		else if (rtd->dai_link->dpcm_capture)
		be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
		memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops));
		} else

Admin message