Skip to content

Commit

Permalink
ASoC: sma1307: Add NULL check in sma1307_setting_loaded()
Browse files Browse the repository at this point in the history
All varibale allocated by kzalloc and devm_kzalloc could be NULL.
Multiple pointer checks and their cleanup are added.

This issue is found by our static analysis tool

Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
Link: https://patch.msgid.link/20250311015714.1333857-1-chenyuan0y@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
  • Loading branch information
Chenyuan Yang authored and Mark Brown committed Mar 16, 2025
1 parent f37ab21 commit 0ec6bd1
Showing 1 changed file with 28 additions and 0 deletions.
28 changes: 28 additions & 0 deletions sound/soc/codecs/sma1307.c
Original file line number Diff line number Diff line change
Expand Up @@ -1723,6 +1723,11 @@ static void sma1307_setting_loaded(struct sma1307_priv *sma1307, const char *fil
}

data = kzalloc(fw->size, GFP_KERNEL);
if (!data) {
release_firmware(fw);
sma1307->set.status = false;
return;
}
size = fw->size >> 2;
memcpy(data, fw->data, fw->size);

Expand All @@ -1736,6 +1741,12 @@ static void sma1307_setting_loaded(struct sma1307_priv *sma1307, const char *fil
sma1307->set.header = devm_kzalloc(sma1307->dev,
sma1307->set.header_size,
GFP_KERNEL);
if (!sma1307->set.header) {
kfree(data);
sma1307->set.status = false;
return;
}

memcpy(sma1307->set.header, data,
sma1307->set.header_size * sizeof(int));

Expand All @@ -1751,6 +1762,13 @@ static void sma1307_setting_loaded(struct sma1307_priv *sma1307, const char *fil
sma1307->set.def
= devm_kzalloc(sma1307->dev,
sma1307->set.def_size * sizeof(int), GFP_KERNEL);
if (!sma1307->set.def) {
kfree(data);
kfree(sma1307->set.header);
sma1307->set.status = false;
return;
}

memcpy(sma1307->set.def,
&data[sma1307->set.header_size],
sma1307->set.def_size * sizeof(int));
Expand All @@ -1763,6 +1781,16 @@ static void sma1307_setting_loaded(struct sma1307_priv *sma1307, const char *fil
= devm_kzalloc(sma1307->dev,
sma1307->set.mode_size * 2 * sizeof(int),
GFP_KERNEL);
if (!sma1307->set.mode_set[i]) {
kfree(data);
kfree(sma1307->set.header);
kfree(sma1307->set.def);
for (int j = 0; j < i; j++)
kfree(sma1307->set.mode_set[j]);
sma1307->set.status = false;
return;
}

for (int j = 0; j < sma1307->set.mode_size; j++) {
sma1307->set.mode_set[i][2 * j]
= data[offset + ((num_mode + 1) * j)];
Expand Down

0 comments on commit 0ec6bd1

Please sign in to comment.