releases/4.16.4/asoc-topology-fix-kcontrol-name-string-handling.patch

   1 From 267e2c6fd7ca3d4076d20f9d52d49dc91addfe9d Mon Sep 17 00:00:00 2001
   2 From: Liam Girdwood <liam.r.girdwood@linux.intel.com>
   3 Date: Tue, 27 Mar 2018 12:04:04 +0100
   4 Subject: ASoC: topology: Fix kcontrol name string handling
   5
   6 From: Liam Girdwood <liam.r.girdwood@linux.intel.com>
   7
   8 commit 267e2c6fd7ca3d4076d20f9d52d49dc91addfe9d upstream.
   9
  10 Fix the topology kcontrol string handling so that string pointer
  11 references are strdup()ed instead of being copied. This fixes issues
  12 with kcontrol templates on the stack or ones that are freed. Remember
  13 and free the strings too when topology is unloaded.
  14
  15 Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
  16 Signed-off-by: Mark Brown <broonie@kernel.org>
  17 Cc: stable@vger.kernel.org
  18 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  19
  20 ---
  21  sound/soc/soc-topology.c |   23 ++++++++++++++++++-----
  22  1 file changed, 18 insertions(+), 5 deletions(-)
  23
  24 --- a/sound/soc/soc-topology.c
  25 +++ b/sound/soc/soc-topology.c
  26 @@ -523,6 +523,7 @@ static void remove_widget(struct snd_soc
  27                                 kfree(se->dobj.control.dtexts[j]);
  28
  29                         kfree(se);
  30 +                       kfree(w->kcontrol_news[i].name);
  31                 }
  32                 kfree(w->kcontrol_news);
  33         } else {
  34 @@ -540,6 +541,7 @@ static void remove_widget(struct snd_soc
  35                          */
  36                         kfree((void *)kcontrol->private_value);
  37                         snd_ctl_remove(card, kcontrol);
  38 +                       kfree(w->kcontrol_news[i].name);
  39                 }
  40                 kfree(w->kcontrol_news);
  41         }
  42 @@ -1233,7 +1235,9 @@ static struct snd_kcontrol_new *soc_tplg
  43                 dev_dbg(tplg->dev, " adding DAPM widget mixer control %s at %d\n",
  44                         mc->hdr.name, i);
  45
  46 -               kc[i].name = mc->hdr.name;
  47 +               kc[i].name = kstrdup(mc->hdr.name, GFP_KERNEL);
  48 +               if (kc[i].name == NULL)
  49 +                       goto err_str;
  50                 kc[i].private_value = (long)sm;
  51                 kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
  52                 kc[i].access = mc->hdr.access;
  53 @@ -1278,8 +1282,10 @@ static struct snd_kcontrol_new *soc_tplg
  54  err_str:
  55         kfree(sm);
  56  err:
  57 -       for (--i; i >= 0; i--)
  58 +       for (--i; i >= 0; i--) {
  59                 kfree((void *)kc[i].private_value);
  60 +               kfree(kc[i].name);
  61 +       }
  62         kfree(kc);
  63         return NULL;
  64  }
  65 @@ -1310,7 +1316,9 @@ static struct snd_kcontrol_new *soc_tplg
  66                 dev_dbg(tplg->dev, " adding DAPM widget enum control %s\n",
  67                         ec->hdr.name);
  68
  69 -               kc[i].name = ec->hdr.name;
  70 +               kc[i].name = kstrdup(ec->hdr.name, GFP_KERNEL);
  71 +               if (kc[i].name == NULL)
  72 +                       goto err_se;
  73                 kc[i].private_value = (long)se;
  74                 kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
  75                 kc[i].access = ec->hdr.access;
  76 @@ -1386,6 +1394,7 @@ err_se:
  77                         kfree(se->dobj.control.dtexts[j]);
  78
  79                 kfree(se);
  80 +               kfree(kc[i].name);
  81         }
  82  err:
  83         kfree(kc);
  84 @@ -1424,7 +1433,9 @@ static struct snd_kcontrol_new *soc_tplg
  85                         "ASoC: adding bytes kcontrol %s with access 0x%x\n",
  86                         be->hdr.name, be->hdr.access);
  87
  88 -               kc[i].name = be->hdr.name;
  89 +               kc[i].name = kstrdup(be->hdr.name, GFP_KERNEL);
  90 +               if (kc[i].name == NULL)
  91 +                       goto err;
  92                 kc[i].private_value = (long)sbe;
  93                 kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
  94                 kc[i].access = be->hdr.access;
  95 @@ -1454,8 +1465,10 @@ static struct snd_kcontrol_new *soc_tplg
  96         return kc;
  97
  98  err:
  99 -       for (--i; i >= 0; i--)
 100 +       for (--i; i >= 0; i--) {
 101                 kfree((void *)kc[i].private_value);
 102 +               kfree(kc[i].name);
 103 +       }
 104
 105         kfree(kc);
 106         return NULL;