From 016c20506d5c30151196ab28c694ab10bc3604e6 Mon Sep 17 00:00:00 2001 From: Jaroslav Kysela Date: Wed, 31 Mar 2021 20:07:02 +0200 Subject: [PATCH 1/2] ALSA: control - add the missing prev_lops2 initialization As static analysis reported, the prev_lops2 should contain the previous lops2 pointer in snd_ctl_disconnect_layer(). Link: https://lore.kernel.org/alsa-devel/96e9bd5c-c8db-0db8-b393-fbf4a047dc80@canonical.com/ Fixes: 3f0638a0333b ("ALSA: control - add layer registration routines") Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20210331180702.663489-1-perex@perex.cz Signed-off-by: Takashi Iwai --- sound/core/control.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/core/control.c b/sound/core/control.c index 6825ca75daf5..20d707d4ef40 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -2074,7 +2074,7 @@ void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops) struct snd_ctl_layer_ops *lops2, *prev_lops2; down_write(&snd_ctl_layer_rwsem); - for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) + for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) { if (lops2 == lops) { if (!prev_lops2) snd_ctl_layer = lops->next; @@ -2082,6 +2082,8 @@ void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops) prev_lops2->next = lops->next; break; } + prev_lops2 = lops2; + } up_write(&snd_ctl_layer_rwsem); } EXPORT_SYMBOL_GPL(snd_ctl_disconnect_layer); From 62327ebbdf0097cda25579522424b350c65422a4 Mon Sep 17 00:00:00 2001 From: Jaroslav Kysela Date: Wed, 31 Mar 2021 20:07:25 +0200 Subject: [PATCH 2/2] ALSA: control led - improve the set_led_id() parser It may be possible that the string pointer does not move when parsing. Add a code which detects this state and simply break the parser loop in this case. Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20210331180725.663623-1-perex@perex.cz Signed-off-by: Takashi Iwai --- sound/core/control_led.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sound/core/control_led.c b/sound/core/control_led.c index d4fb8b873f34..788fd9e275e0 100644 --- a/sound/core/control_led.c +++ b/sound/core/control_led.c @@ -506,7 +506,7 @@ static char *parse_iface(char *s, unsigned int *val) static ssize_t set_led_id(struct snd_ctl_led_card *led_card, const char *buf, size_t count, bool attach) { - char buf2[256], *s; + char buf2[256], *s, *os; size_t len = max(sizeof(s) - 1, count); struct snd_ctl_elem_id id; int err; @@ -517,6 +517,7 @@ static ssize_t set_led_id(struct snd_ctl_led_card *led_card, const char *buf, si id.iface = SNDRV_CTL_ELEM_IFACE_MIXER; s = buf2; while (*s) { + os = s; if (!strncasecmp(s, "numid=", 6)) { s = parse_uint(s + 6, &id.numid); } else if (!strncasecmp(s, "iface=", 6)) { @@ -546,6 +547,8 @@ static ssize_t set_led_id(struct snd_ctl_led_card *led_card, const char *buf, si } if (*s == ',') s++; + if (s == os) + break; } err = snd_ctl_led_set_id(led_card->number, &id, led_card->led->group, attach);