summaryrefslogtreecommitdiff
path: root/sound/soc/soc-topology.c
diff options
context:
space:
mode:
authorLiam Girdwood <liam.r.girdwood@linux.intel.com>2018-03-14 20:42:40 +0000
committerMark Brown <broonie@kernel.org>2018-03-19 15:12:54 +0800
commit05bdcf12905533b8628627b6634608cd3b57c607 (patch)
tree65c984ba3432cf16ae511dd9dae9191acaf47c6e /sound/soc/soc-topology.c
parentbde8b3887add8368ecf0ca71117baf2fd56a6fc9 (diff)
ASoC: topology: Check widget kcontrols before deref.
Validate the topology input before we dereference the pointer. Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound/soc/soc-topology.c')
-rw-r--r--sound/soc/soc-topology.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index e81b52600d58..b363f2409f72 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -504,6 +504,9 @@ static void remove_widget(struct snd_soc_component *comp,
if (dobj->ops && dobj->ops->widget_unload)
dobj->ops->widget_unload(comp, dobj);
+ if (!w->kcontrols)
+ goto free_news;
+
/*
* Dynamic Widgets either have 1..N enum kcontrols or mixers.
* The enum may either have an array of values or strings.
@@ -524,7 +527,6 @@ static void remove_widget(struct snd_soc_component *comp,
kfree(se);
}
- kfree(w->kcontrol_news);
} else {
/* volume mixer or bytes controls */
for (i = 0; i < w->num_kcontrols; i++) {
@@ -541,8 +543,11 @@ static void remove_widget(struct snd_soc_component *comp,
kfree((void *)kcontrol->private_value);
snd_ctl_remove(card, kcontrol);
}
- kfree(w->kcontrol_news);
}
+
+free_news:
+ kfree(w->kcontrol_news);
+
/* widget w is freed by soc-dapm.c */
}