samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

asoc: Avoid usage of variable length array

Browse Source 
chmap in msm_lsm_check_and_set_lab_controls, data in
wcd9xxx_i2c_write_device and irq_level in wcd9xxx_irq_init
are Variable Length Array (VLA). VLAs are considered unfit
when it comes to security, performance, code quality and so
on. Hence, allocate the memory dynamically.

Change-Id: I52f33e61f857a00774eb26dc1d6372f2ed3d425c
Signed-off-by: Meng Wang <mengw@codeaurora.org>
This commit is contained in:
Meng Wang
2018-11-13 09:28:48 +08:00
committed by Gerrit - the friendly Code Review server
parent 61af6849e9
commit c7b180ec7c
3 changed files with 30 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
asoc/codecs/wcd9xxx-core.c
View File

@@ -844,7 +844,7 @@ static int wcd9xxx_i2c_write_device(struct wcd9xxx *wcd9xxx, u16 reg, u8 *value,
struct i2c_msg *msg;
int ret = 0;
u8 reg_addr = 0;
u8 data[bytes + 1];
u8 *data = NULL;
struct wcd9xxx_i2c *wcd9xxx_i2c;
wcd9xxx_i2c = wcd9xxx_i2c_get_device_info(wcd9xxx, reg);
@@ -852,6 +852,11 @@ static int wcd9xxx_i2c_write_device(struct wcd9xxx *wcd9xxx, u16 reg, u8 *value,
pr_err("failed to get device info\n");
return -ENODEV;
}
data = kzalloc(bytes + 1, GFP_KERNEL);
if (!data)
return -ENOMEM;
reg_addr = (u8)reg;
msg = &wcd9xxx_i2c->xfer_msg[0];
msg->addr = wcd9xxx_i2c->client->addr;
@@ -868,11 +873,13 @@ static int wcd9xxx_i2c_write_device(struct wcd9xxx *wcd9xxx, u16 reg, u8 *value,
wcd9xxx_i2c->xfer_msg, 1);
if (ret != 1) {
pr_err("failed to write the device\n");
return ret;
goto fail;
}
}
pr_debug("write success register = %x val = %x\n", reg, data[1]);
return 0;
fail:
kfree(data);
return ret;
}

17
asoc/codecs/wcd9xxx-irq.c
View File

@@ -1,5 +1,5 @@
// SPDX-License-Identifier: GPL-2.0
/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
/* Copyright (c) 2011-2018, The Linux Foundation. All rights reserved.
*/
#include <linux/bitops.h>
#include <linux/kernel.h>
@@ -525,7 +525,7 @@ static int wcd9xxx_irq_setup_downstream_irq(
int wcd9xxx_irq_init(struct wcd9xxx_core_resource *wcd9xxx_res)
{
int i, ret;
u8 irq_level[wcd9xxx_res->num_irq_regs];
u8 *irq_level = NULL;
struct irq_domain *domain;
struct device_node *pnode;
@@ -555,9 +555,7 @@ int wcd9xxx_irq_init(struct wcd9xxx_core_resource *wcd9xxx_res)
ret = wcd9xxx_irq_setup_downstream_irq(wcd9xxx_res);
if (ret) {
pr_err("%s: Failed to setup downstream IRQ\n", __func__);
wcd9xxx_irq_put_upstream_irq(wcd9xxx_res);
mutex_destroy(&wcd9xxx_res->irq_lock);
mutex_destroy(&wcd9xxx_res->nested_irq_lock);
goto fail_irq_level;
return ret;
}
@@ -565,7 +563,11 @@ int wcd9xxx_irq_init(struct wcd9xxx_core_resource *wcd9xxx_res)
wcd9xxx_res->irq_level_high[0] = true;
/* mask all the interrupts */
memset(irq_level, 0, wcd9xxx_res->num_irq_regs);
irq_level = kzalloc(wcd9xxx_res->num_irq_regs, GFP_KERNEL);
if (!irq_level) {
ret = -ENOMEM;
goto fail_irq_level;
}
for (i = 0; i < wcd9xxx_res->num_irqs; i++) {
wcd9xxx_res->irq_masks_cur[BIT_BYTE(i)] |= BYTE_BIT_MASK(i);
wcd9xxx_res->irq_masks_cache[BIT_BYTE(i)] |= BYTE_BIT_MASK(i);
@@ -610,11 +612,14 @@ int wcd9xxx_irq_init(struct wcd9xxx_core_resource *wcd9xxx_res)
if (ret)
goto fail_irq_init;
kfree(irq_level);
return ret;
fail_irq_init:
dev_err(wcd9xxx_res->dev,
"%s: Failed to init wcd9xxx irq\n", __func__);
kfree(irq_level);
fail_irq_level:
wcd9xxx_irq_put_upstream_irq(wcd9xxx_res);
mutex_destroy(&wcd9xxx_res->irq_lock);
mutex_destroy(&wcd9xxx_res->nested_irq_lock);

13
asoc/msm-lsm-client.c
View File

@@ -729,7 +729,7 @@ static int msm_lsm_check_and_set_lab_controls(struct snd_pcm_substream *substrea
struct lsm_priv *prtd = runtime->private_data;
struct snd_soc_pcm_runtime *rtd = substream->private_data;
struct lsm_hw_params *out_hw_params = &prtd->lsm_client->out_hw_params;
u8 chmap[out_hw_params->num_chs];
u8 *chmap = NULL;
u32 ch_idx;
int rc = 0, stage_idx = p_info->stage_idx;
@@ -740,11 +740,15 @@ static int msm_lsm_check_and_set_lab_controls(struct snd_pcm_substream *substrea
return rc;
}
chmap = kzalloc(out_hw_params->num_chs, GFP_KERNEL);
if (!chmap)
return -ENOMEM;
rc = q6lsm_lab_control(prtd->lsm_client, enable, p_info);
if (rc) {
dev_err(rtd->dev, "%s: Failed to set lab_control param, err = %d\n",
__func__, rc);
return rc;
goto fail;
} else {
if (LSM_IS_LAST_STAGE(prtd->lsm_client, stage_idx)) {
rc = msm_lsm_lab_buffer_alloc(prtd,
@@ -753,7 +757,7 @@ static int msm_lsm_check_and_set_lab_controls(struct snd_pcm_substream *substrea
dev_err(rtd->dev,
"%s: msm_lsm_lab_buffer_alloc failed rc %d for %s\n",
__func__, rc, enable ? "ALLOC" : "DEALLOC");
return rc;
goto fail;
} else {
/* set client level flag based on last stage control */
prtd->lsm_client->lab_enable = enable;
@@ -763,7 +767,6 @@ static int msm_lsm_check_and_set_lab_controls(struct snd_pcm_substream *substrea
prtd->lsm_client->stage_cfg[stage_idx].lab_enable = enable;
}
memset(chmap, 0, out_hw_params->num_chs);
/*
* First channel to be read from lab is always the
* best channel (0xff). For second channel onwards,
@@ -778,6 +781,8 @@ static int msm_lsm_check_and_set_lab_controls(struct snd_pcm_substream *substrea
dev_err(rtd->dev, "%s: Failed to set lab out ch cfg %d\n",
__func__, rc);
fail:
kfree(chmap);
return rc;
}