OrgACRN
/
sof
mirror of https://github.com/thesofproject/sof.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

core: ipc: Fix error handling pointer deref 

elem.next/prev can be accessed whilst NULL in certain error handling
conditions.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
This commit is contained in:
Liam Girdwood 2018-03-16 13:22:11 +00:00
parent 25233ea17a
commit 0c0281ba3f
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/ipc/intel-ipc.c
View File

@ -254,6 +254,9 @@ static int ipc_stream_pcm_params(uint32_t stream)
cd->params = pcm_params->params; cd->params = pcm_params->params;
#ifdef CONFIG_HOST_PTABLE #ifdef CONFIG_HOST_PTABLE
list_init(&elem_list);
/* use DMA to read in compressed page table ringbuffer from host */ /* use DMA to read in compressed page table ringbuffer from host */
err = get_page_descriptors(iipc, &pcm_params->params.buffer); err = get_page_descriptors(iipc, &pcm_params->params.buffer);
if (err < 0) { if (err < 0) {
@ -264,7 +267,6 @@ static int ipc_stream_pcm_params(uint32_t stream)
/* Parse host tables */ /* Parse host tables */
host = (struct sof_ipc_comp_host *)&cd->comp; host = (struct sof_ipc_comp_host *)&cd->comp;
ring_size = pcm_params->params.buffer.size; ring_size = pcm_params->params.buffer.size;
list_init(&elem_list);
err = parse_page_descriptors(iipc, &pcm_params->params.buffer, err = parse_page_descriptors(iipc, &pcm_params->params.buffer,
&elem_list, host->direction); &elem_list, host->direction);
@ -650,6 +652,9 @@ static int ipc_dma_trace_config(uint32_t header)
trace_ipc_error("DA1"); trace_ipc_error("DA1");
#ifdef CONFIG_HOST_PTABLE #ifdef CONFIG_HOST_PTABLE
list_init(&elem_list);
/* use DMA to read in compressed page table ringbuffer from host */ /* use DMA to read in compressed page table ringbuffer from host */
err = get_page_descriptors(iipc, &params->buffer); err = get_page_descriptors(iipc, &params->buffer);
if (err < 0) { if (err < 0) {
@ -661,7 +666,6 @@ static int ipc_dma_trace_config(uint32_t header)
/* Parse host tables */ /* Parse host tables */
ring_size = params->buffer.size; ring_size = params->buffer.size;
list_init(&elem_list);
err = parse_page_descriptors(iipc, &params->buffer, err = parse_page_descriptors(iipc, &params->buffer,
&elem_list, SOF_IPC_STREAM_CAPTURE); &elem_list, SOF_IPC_STREAM_CAPTURE);