evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sound: usb: Fix format desc usage for BADD 3.0 devices

Browse source 
For a BADD device, the audioformat structure was directly
being populated without initialising the format type
descriptor. This can lead to a crash later when the
format  type and rates are being parsed but the NULL fmt
desc is dereferenced. Fix this by allocating a dummy copy
of fmt desc for BADD 3.0 devices and populating
necessary fields.

Change-Id: I80f33b0e400a9c522a800e989228da134100bb55
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
This commit is contained in:
Ajay Agarwal 2017-05-05 15:05:51 +05:30
parent 9416e47b01
commit 82fe037ea7
1 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
sound/usb/stream.c
View file

@ -652,6 +652,16 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
case UAC_VERSION_3: { case UAC_VERSION_3: {
int wMaxPacketSize; int wMaxPacketSize;
/*
* Allocate a dummy instance of fmt and set format type
* to UAC_FORMAT_TYPE_I for BADD support; free fmt
* after its last usage
*/
fmt = kzalloc(sizeof(*fmt), GFP_KERNEL);
if (!fmt)
return -ENOMEM;
fmt->bFormatType = UAC_FORMAT_TYPE_I;
format = UAC_FORMAT_TYPE_I_PCM; format = UAC_FORMAT_TYPE_I_PCM;
clock = BADD_CLOCK_SOURCE; clock = BADD_CLOCK_SOURCE;
wMaxPacketSize = le16_to_cpu(get_endpoint(alts, 0) wMaxPacketSize = le16_to_cpu(get_endpoint(alts, 0)
@ -678,6 +688,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
dev_err(&dev->dev, dev_err(&dev->dev,
"%u:%d: invalid wMaxPacketSize\n", "%u:%d: invalid wMaxPacketSize\n",
iface_no, altno); iface_no, altno);
kfree(fmt);
continue; continue;
} }
} }
@ -776,6 +787,8 @@ populate_fp:
continue; continue;
} }
if (protocol == UAC_VERSION_3)
kfree(fmt);
/* Create chmap */ /* Create chmap */
if (fp->channels != num_channels) if (fp->channels != num_channels)
chconfig = 0; chconfig = 0;