Commit 05bdcf12 authored by Liam Girdwood's avatar Liam Girdwood Committed by Mark Brown

ASoC: topology: Check widget kcontrols before deref.

Validate the topology input before we dereference the pointer.
Signed-off-by: default avatarLiam Girdwood <liam.r.girdwood@linux.intel.com>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent bde8b388
...@@ -504,6 +504,9 @@ static void remove_widget(struct snd_soc_component *comp, ...@@ -504,6 +504,9 @@ static void remove_widget(struct snd_soc_component *comp,
if (dobj->ops && dobj->ops->widget_unload) if (dobj->ops && dobj->ops->widget_unload)
dobj->ops->widget_unload(comp, dobj); dobj->ops->widget_unload(comp, dobj);
if (!w->kcontrols)
goto free_news;
/* /*
* Dynamic Widgets either have 1..N enum kcontrols or mixers. * Dynamic Widgets either have 1..N enum kcontrols or mixers.
* The enum may either have an array of values or strings. * The enum may either have an array of values or strings.
...@@ -524,7 +527,6 @@ static void remove_widget(struct snd_soc_component *comp, ...@@ -524,7 +527,6 @@ static void remove_widget(struct snd_soc_component *comp,
kfree(se); kfree(se);
} }
kfree(w->kcontrol_news);
} else { } else {
/* volume mixer or bytes controls */ /* volume mixer or bytes controls */
for (i = 0; i < w->num_kcontrols; i++) { for (i = 0; i < w->num_kcontrols; i++) {
...@@ -541,8 +543,11 @@ static void remove_widget(struct snd_soc_component *comp, ...@@ -541,8 +543,11 @@ static void remove_widget(struct snd_soc_component *comp,
kfree((void *)kcontrol->private_value); kfree((void *)kcontrol->private_value);
snd_ctl_remove(card, kcontrol); snd_ctl_remove(card, kcontrol);
} }
kfree(w->kcontrol_news);
} }
free_news:
kfree(w->kcontrol_news);
/* widget w is freed by soc-dapm.c */ /* widget w is freed by soc-dapm.c */
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment