From 05bdcf12905533b8628627b6634608cd3b57c607 Mon Sep 17 00:00:00 2001
From: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Date: Wed, 14 Mar 2018 20:42:40 +0000
Subject: [PATCH] ASoC: topology: Check widget kcontrols before deref.
Git-commit: 05bdcf12905533b8628627b6634608cd3b57c607
Patch-mainline: v4.17-rc1
References: bsc#1051510
Validate the topology input before we dereference the pointer.
Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Acked-by: Takashi Iwai <tiwai@suse.de>
---
sound/soc/soc-topology.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -485,6 +485,9 @@ static void remove_widget(struct snd_soc
if (dobj->ops && dobj->ops->widget_unload)
dobj->ops->widget_unload(comp, dobj);
+ if (!w->kcontrols)
+ goto free_news;
+
/*
* Dynamic Widgets either have 1..N enum kcontrols or mixers.
* The enum may either have an array of values or strings.
@@ -506,7 +509,6 @@ static void remove_widget(struct snd_soc
kfree(se);
kfree(w->kcontrol_news[i].name);
}
- kfree(w->kcontrol_news);
} else {
/* volume mixer or bytes controls */
for (i = 0; i < w->num_kcontrols; i++) {
@@ -524,8 +526,11 @@ static void remove_widget(struct snd_soc
snd_ctl_remove(card, kcontrol);
kfree(w->kcontrol_news[i].name);
}
- kfree(w->kcontrol_news);
}
+
+free_news:
+ kfree(w->kcontrol_news);
+
/* widget w is freed by soc-dapm.c */
}