Commit b0035df5 authored by Shenghao Ding's avatar Shenghao Ding Committed by Takashi Iwai
Browse files

ALSA: hda/tas2781: Fix a potential race condition that causes a NULL pointer... 


ALSA: hda/tas2781: Fix a potential race condition that causes a NULL pointer in case no efi.get_variable exsits

A a potential race condition reported by one of my customers that leads to
a NULL pointer dereference, where the call to efi.get_variable should be
guarded with efi_rt_services_supported() to ensure that function exists.

Fixes: 4fe23851 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib")
Signed-off-by: default avatarShenghao Ding <shenghao-ding@ti.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 71d2893a

sound/hda/codecs/side-codecs/tas2781_hda.c

+5 −0
Original line number Diff line number Diff line
@@ -193,6 +193,11 @@ int tas2781_save_calibration(struct tas2781_hda *hda) 
	efi_status_t status;

	int i;



	if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) {

		dev_err(p->dev, "%s: NO EFI FOUND!\n", __func__);

		return -EINVAL;

	}



	if (hda->catlog_id < LENOVO)

		efi_guid = tasdev_fct_efi_guid[hda->catlog_id];

sound/hda/codecs/side-codecs/tas2781_hda_i2c.c

+5 −0
Original line number Diff line number Diff line
@@ -315,6 +315,11 @@ static int tas2563_save_calibration(struct tas2781_hda *h) 
	unsigned int attr;

	int ret, i, j, k;



	if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) {

		dev_err(p->dev, "%s: NO EFI FOUND!\n", __func__);

		return -EINVAL;

	}



	cd->cali_dat_sz_per_dev = TAS2563_CAL_DATA_SIZE * TASDEV_CALIB_N;



	/* extra byte for each device is the device number */