diff options
| author | Shengjiu Wang <shengjiu.wang@nxp.com> | 2019-07-11 18:25:13 +0800 |
|---|---|---|
| committer | Shengjiu Wang <shengjiu.wang@nxp.com> | 2019-07-11 19:00:32 +0800 |
| commit | 70bda4e5532b54da3b6ea7f48a37659a5b814108 (patch) | |
| tree | 4444fef7cffb795d6f53cfffc97b8ef50b7db05b /sound | |
| parent | 2f6744d6ba2045b51846fe6b8b280b854a12c475 (diff) | |
MLK-22254: ASoC: fsl_easrc: Fix issue reported by coverity
Fix issue reported by coverity:
a. Resource leak for ctx is not freed when m2m allocation
failed
b. Use of untrusted scalar value
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/fsl/fsl_easrc_m2m.c | 30 |
1 files changed, 15 insertions, 15 deletions
diff --git a/sound/soc/fsl/fsl_easrc_m2m.c b/sound/soc/fsl/fsl_easrc_m2m.c index 257f8588d77b..38abfc8a7791 100644 --- a/sound/soc/fsl/fsl_easrc_m2m.c +++ b/sound/soc/fsl/fsl_easrc_m2m.c @@ -212,7 +212,6 @@ static long fsl_easrc_prepare_io_buffer(struct fsl_easrc_m2m *m2m, unsigned int buf_len, bits; u32 fifo_addr; void __user *buf_vaddr; - int ret; if (dir == IN) { buf_vaddr = (void __user *)buf->input_buffer_vaddr; @@ -226,19 +225,16 @@ static long fsl_easrc_prepare_io_buffer(struct fsl_easrc_m2m *m2m, fifo_addr = easrc->paddr + REG_EASRC_RDFIFO(index); } - if (dir == IN) { - ret = copy_from_user(dma_vaddr, buf_vaddr, buf_len); - if (ret) { - dev_err(dev, "failed to copy input buffer %d\n", ret); - return ret; - } - - if (buf_len % (bits / 8)) { - dev_err(dev, "input buffer size error\n"); - return -EINVAL; - } + if (buf_len > EASRC_DMA_BUFFER_SIZE || + (dir == IN && (buf_len % (bits / 8)))) { + dev_err(dev, "%sput buffer size is error: [%d]\n", + DIR_STR(dir), buf_len); + return -EINVAL; } + if (dir == IN && copy_from_user(dma_vaddr, buf_vaddr, buf_len)) + return -EFAULT; + *dma_len = buf_len; if (dir == OUT) @@ -810,9 +806,10 @@ static int fsl_easrc_open(struct inode *inode, struct file *file) /* set the pointer to easrc private data */ m2m = kzalloc(sizeof(*m2m), GFP_KERNEL); - if (!m2m) - return -ENOMEM; - + if (!m2m) { + ret = -ENOMEM; + goto out; + } /* just save the pointer to easrc private data */ m2m->easrc = easrc; m2m->ctx = ctx; @@ -827,6 +824,9 @@ static int fsl_easrc_open(struct inode *inode, struct file *file) pm_runtime_get_sync(dev); return 0; +out: + kfree(ctx); + return ret; } static int fsl_easrc_close(struct inode *inode, struct file *file) |