From patchwork Mon Jun 3 10:28:15 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Amadeusz_S=C5=82awi=C5=84ski?= X-Patchwork-Id: 13683576 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2004081AC7 for ; Mon, 3 Jun 2024 10:27:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.16 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717410461; cv=none; b=LldKl08kbpZcPFBkeg4e/yftmksDiuETHyANIGJJ6U6SUJcaZ97yd86RViNANmDiukmaNcuuKuA1qz4Yq7csrVVUVnUvWwn5tIzygtmcA3r9t2JA7mB4iWScLWJVXG4LLyEF0tzCi2iHiOqGT7PsVgLf4TFcs7mXckjFjw5FagY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717410461; c=relaxed/simple; bh=7NV3o9KauOpeQYT9WlCJbRb3c/G3kEQbMf65uPt62WU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version:Content-Type; b=MH42eXZQYrtygchRMNj5t76+wi8AM1QRwjvWRShSHFLfQFGgmwubkbF3IDgfhTNCCugStE3k3HBONpKQJvTfZAcVUCq7SKn/xBQk5gCKd6N6fAH/MKynv5Fu2KbbnrB8bUgg0HD2rIQXKufstkz29vIIiAwF5x1Gc0c6DmbjRMU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=none smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Chxoys6h; arc=none smtp.client-ip=198.175.65.16 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Chxoys6h" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1717410460; x=1748946460; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=7NV3o9KauOpeQYT9WlCJbRb3c/G3kEQbMf65uPt62WU=; b=Chxoys6hpSVKJ0IYxLEJ40gw9NIc6VGqsv4/pHvH+Y7XBYNUcKzeaBKy Zi/MFo+cKGjTlIza88CzsjSDdb9/uYd1pucRZvAzpr+hk7quWSWObHOEb 8rNLRXwXxM225IarD75n7adCRaltMBmSbvV1qEV0RZbLJX+u4f+axqtBs I1bw+S5GOjpRem7uvnALNvFrWnhZl6D5FrTWIE8MpklI1M46zuFXHOPuC 2tIv2fT3+WVgVRh2mNsY0j/g7C4Gno3GDpy9X7Vae1c3k8S0yuCwpYRjN OBnBiUuoWfU82vHzipaJuQv99fBIxE+6/IJWuIAL14RJJU2Q/hHTsPgC7 g==; X-CSE-ConnectionGUID: 9d71HD5MQgmTwsYN17h38w== X-CSE-MsgGUID: yN4yLc/PQMKdwsUEcriz3A== X-IronPort-AV: E=McAfee;i="6600,9927,11091"; a="14017212" X-IronPort-AV: E=Sophos;i="6.08,211,1712646000"; d="scan'208";a="14017212" Received: from orviesa008.jf.intel.com ([10.64.159.148]) by orvoesa108.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Jun 2024 03:27:40 -0700 X-CSE-ConnectionGUID: LS3e7dOITR6X6UVDljEwfg== X-CSE-MsgGUID: cNZioXGnQBG8Y3II7cVKHQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.08,211,1712646000"; d="scan'208";a="37430034" Received: from dev2 (HELO DEV2.igk.intel.com) ([10.237.148.94]) by orviesa008.jf.intel.com with ESMTP; 03 Jun 2024 03:27:38 -0700 From: =?utf-8?q?Amadeusz_S=C5=82awi=C5=84ski?= To: Mark Brown Cc: Cezary Rojewski , Pierre-Louis Bossart , Ranjani Sridharan , Takashi Iwai , Jaroslav Kysela , alsa-devel@alsa-project.org, linux-sound@vger.kernel.org, Jason Montleon , =?utf-8?q?Amadeusz_S=C5=82awi=C5=84sk?= =?utf-8?q?i?= Subject: [PATCH 1/4] ASoC: topology: Fix references to freed memory Date: Mon, 3 Jun 2024 12:28:15 +0200 Message-Id: <20240603102818.36165-2-amadeuszx.slawinski@linux.intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240603102818.36165-1-amadeuszx.slawinski@linux.intel.com> References: <20240603102818.36165-1-amadeuszx.slawinski@linux.intel.com> Precedence: bulk X-Mailing-List: linux-sound@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Most users after parsing a topology file, release memory used by it, so having pointer references directly into topology file contents is wrong. Use devm_kmemdup(), to allocate memory as needed. Reported-by: Jason Montleon Link: https://github.com/thesofproject/avs-topology-xml/issues/22#issuecomment-2127892605 Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński --- sound/soc/soc-topology.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c index 90ca37e008b32..75d9395a18ed4 100644 --- a/sound/soc/soc-topology.c +++ b/sound/soc/soc-topology.c @@ -1060,15 +1060,32 @@ static int soc_tplg_dapm_graph_elems_load(struct soc_tplg *tplg, break; } - route->source = elem->source; - route->sink = elem->sink; + route->source = devm_kmemdup(tplg->dev, elem->source, + min(strlen(elem->source), + SNDRV_CTL_ELEM_ID_NAME_MAXLEN), + GFP_KERNEL); + route->sink = devm_kmemdup(tplg->dev, elem->sink, + min(strlen(elem->sink), SNDRV_CTL_ELEM_ID_NAME_MAXLEN), + GFP_KERNEL); + if (!route->source || !route->sink) { + ret = -ENOMEM; + break; + } /* set to NULL atm for tplg users */ route->connected = NULL; - if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) == 0) + if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) == 0) { route->control = NULL; - else - route->control = elem->control; + } else { + route->control = devm_kmemdup(tplg->dev, elem->control, + min(strlen(elem->control), + SNDRV_CTL_ELEM_ID_NAME_MAXLEN), + GFP_KERNEL); + if (!route->control) { + ret = -ENOMEM; + break; + } + } /* add route dobj to dobj_list */ route->dobj.type = SND_SOC_DOBJ_GRAPH;