ALSA: asihpi - Unsafe memory management when allocating control cache
I noticed that sound/pci/asihpi/hpicmn.c::hpi_alloc_control_cache() does not check the return value from kmalloc(), which may fail. If kmalloc() fails we'll dereference a null pointer and things will go bad fast. There are two memory allocations in that function and there's also the problem that the first may succeed and the second may fail and nothing is done about that either which will also go wrong down the line. Signed-off-by: Jesper Juhl <jj@chaosbits.net> Acked-by: Eliot Blennerhassett <linux@audioscience.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Этот коммит содержится в:

коммит произвёл
Takashi Iwai

родитель
f746745229
Коммит
fd0977d0f4
@@ -571,14 +571,20 @@ struct hpi_control_cache *hpi_alloc_control_cache(const u32
|
||||
{
|
||||
struct hpi_control_cache *p_cache =
|
||||
kmalloc(sizeof(*p_cache), GFP_KERNEL);
|
||||
if (!p_cache)
|
||||
return NULL;
|
||||
p_cache->p_info =
|
||||
kmalloc(sizeof(*p_cache->p_info) * number_of_controls,
|
||||
GFP_KERNEL);
|
||||
if (!p_cache->p_info) {
|
||||
kfree(p_cache);
|
||||
return NULL;
|
||||
}
|
||||
p_cache->cache_size_in_bytes = size_in_bytes;
|
||||
p_cache->control_count = number_of_controls;
|
||||
p_cache->p_cache =
|
||||
(struct hpi_control_cache_single *)pDSP_control_buffer;
|
||||
p_cache->init = 0;
|
||||
p_cache->p_info =
|
||||
kmalloc(sizeof(*p_cache->p_info) * p_cache->control_count,
|
||||
GFP_KERNEL);
|
||||
return p_cache;
|
||||
}
|
||||
|
||||
|
Ссылка в новой задаче
Block a user