Unverified Commit 97ab304e authored by Amadeusz Sławiński's avatar Amadeusz Sławiński Committed by Mark Brown
Browse files

ASoC: topology: Fix references to freed memory 



Most users after parsing a topology file, release memory used by it, so
having pointer references directly into topology file contents is wrong.
Use devm_kmemdup(), to allocate memory as needed.

Reported-by: default avatarJason Montleon <jmontleo@redhat.com>
Link: https://github.com/thesofproject/avs-topology-xml/issues/22#issuecomment-2127892605


Reviewed-by: default avatarCezary Rojewski <cezary.rojewski@intel.com>
Signed-off-by: default avatarAmadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Link: https://lore.kernel.org/r/20240603102818.36165-2-amadeuszx.slawinski@linux.intel.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 2ed22161

sound/soc/soc-topology.c

+22 −5
Original line number Diff line number Diff line
@@ -1060,15 +1060,32 @@ static int soc_tplg_dapm_graph_elems_load(struct soc_tplg *tplg, 
			break;

		}



		route->source = elem->source;

		route->sink = elem->sink;

		route->source = devm_kmemdup(tplg->dev, elem->source,

					     min(strlen(elem->source),

						 SNDRV_CTL_ELEM_ID_NAME_MAXLEN),

					     GFP_KERNEL);

		route->sink = devm_kmemdup(tplg->dev, elem->sink,

					   min(strlen(elem->sink), SNDRV_CTL_ELEM_ID_NAME_MAXLEN),

					   GFP_KERNEL);

		if (!route->source || !route->sink) {

			ret = -ENOMEM;

			break;

		}



		/* set to NULL atm for tplg users */

		route->connected = NULL;

		if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) == 0)

		if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) == 0) {

			route->control = NULL;

		else

			route->control = elem->control;

		} else {

			route->control = devm_kmemdup(tplg->dev, elem->control,

						      min(strlen(elem->control),

							  SNDRV_CTL_ELEM_ID_NAME_MAXLEN),

						      GFP_KERNEL);

			if (!route->control) {

				ret = -ENOMEM;

				break;

			}

		}



		/* add route dobj to dobj_list */

		route->dobj.type = SND_SOC_DOBJ_GRAPH;