greybus: audio: Add check for invalid index while mapping control

While mapping control id to define DAPM routes, invalid control index
may cause kernel oops. Add extra check to validate index while mapping
names to control_id.

Signed-off-by: Vaibhav Agarwal <vaibhav.agarwal@linaro.org>
Reviewed-by: Mark Greer <mgreer@animalcreek.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

diff --git a/drivers/staging/greybus/audio_codec.h b/drivers/staging/greybus/audio_codec.h
index 0de2ad99003b98349d754b241b6542fd85d03803..0153809e72abeeedc48058f56f2c2d6f663182f8 100644 (file)
--- a/drivers/staging/greybus/audio_codec.h
+++ b/drivers/staging/greybus/audio_codec.h
@@ -132,6 +132,7 @@ struct gbaudio_control {
        char *name;
        char *wname;
        const char * const *texts;
+       int items;
        struct list_head list;
 };
 

diff --git a/drivers/staging/greybus/audio_topology.c b/drivers/staging/greybus/audio_topology.c
index 937529653cd33d7ee42b4a1143949d6fe84d3249..5c5b813b75d31c7a088e07b5a046518140650b04 100644 (file)
--- a/drivers/staging/greybus/audio_topology.c
+++ b/drivers/staging/greybus/audio_topology.c
@@ -64,6 +64,8 @@ static const char *gbaudio_map_controlid(struct gbaudio_module_info *module,
                if (control->id == control_id) {
                        if (index == GBAUDIO_INVALID_ID)
                                return control->name;
+                       if (index >= control->items)
+                               return NULL;
                        return control->texts[index];
                }
        }
@@ -71,6 +73,8 @@ static const char *gbaudio_map_controlid(struct gbaudio_module_info *module,
                if (control->id == control_id) {
                        if (index == GBAUDIO_INVALID_ID)
                                return control->name;
+                       if (index >= control->items)
+                               return NULL;
                        return control->texts[index];
                }
        }
@@ -1038,6 +1042,7 @@ static int gbaudio_tplg_create_widget(struct gbaudio_module_info *module,
                        csize += gbenum->names_length;
                        control->texts = (const char * const *)
                                gb_generate_enum_strings(module, gbenum);
+                       control->items = gbenum->items;
                } else
                        csize = sizeof(struct gb_audio_control);
                *w_size += csize;
@@ -1184,6 +1189,7 @@ static int gbaudio_tplg_process_kcontrols(struct gbaudio_module_info *module,
                        csize += gbenum->names_length;
                        control->texts = (const char * const *)
                                gb_generate_enum_strings(module, gbenum);
+                       control->items = gbenum->items;
                } else
                        csize = sizeof(struct gb_audio_control);