summaryrefslogtreecommitdiff
path: root/sound/core
diff options
context:
space:
mode:
authorSrikanth K H <srikanth.h@samsung.com>2018-07-20 08:43:51 +0300
committerTakashi Iwai <tiwai@suse.de>2018-07-22 11:42:41 +0300
commitd10ee9c542365bdc0a7497306e21ff6c7f2172b0 (patch)
treea61c0a181b0348cba7f3415a550d5f4d77014622 /sound/core
parent7abeb64da6deeffa52f74e3b1e19d2c9e2c3ae6b (diff)
downloadlinux-d10ee9c542365bdc0a7497306e21ff6c7f2172b0.tar.xz
ALSA: timer: catch invalid timer object creation
A timer object for the classes SNDRV_TIMER_CLASS_CARD and SNDRV_TIMER_CLASS_PCM has to be associated with a card object, but we have no check at creation time. Such a timer object with NULL card causes various unexpected problems, e.g. NULL dereference at reading the sound timer proc file. So as preventive measure while the creating the sound timer object is created the card information availability is checked for the mentioned entries and returned error if its NULL. Signed-off-by: Srikanth K H <srikanth.h@samsung.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core')
-rw-r--r--sound/core/timer.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/sound/core/timer.c b/sound/core/timer.c
index b6f076bbc72d..61a0cec6e1f6 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -883,6 +883,11 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
if (snd_BUG_ON(!tid))
return -EINVAL;
+ if (tid->dev_class == SNDRV_TIMER_CLASS_CARD ||
+ tid->dev_class == SNDRV_TIMER_CLASS_PCM) {
+ if (WARN_ON(!card))
+ return -EINVAL;
+ }
if (rtimer)
*rtimer = NULL;
timer = kzalloc(sizeof(*timer), GFP_KERNEL);