Skip to content

Commit

Permalink
ALSA: timer: catch invalid timer object creation
Browse files Browse the repository at this point in the history
A timer object for the classes SNDRV_TIMER_CLASS_CARD and
SNDRV_TIMER_CLASS_PCM has to be associated with a card object, but we
have no check at creation time.  Such a timer object with NULL card
causes various unexpected problems, e.g. NULL dereference at reading
the sound timer proc file.

So as preventive measure while the creating the sound timer object is
created the card information availability is checked for the mentioned
entries and returned error if its NULL.

Signed-off-by: Srikanth K H <srikanth.h@samsung.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
Srikanth K H authored and Takashi Iwai committed Jul 22, 2018
1 parent 7abeb64 commit d10ee9c
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions sound/core/timer.c
Original file line number Diff line number Diff line change
Expand Up @@ -883,6 +883,11 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,

if (snd_BUG_ON(!tid))
return -EINVAL;
if (tid->dev_class == SNDRV_TIMER_CLASS_CARD ||
tid->dev_class == SNDRV_TIMER_CLASS_PCM) {
if (WARN_ON(!card))
return -EINVAL;
}
if (rtimer)
*rtimer = NULL;
timer = kzalloc(sizeof(*timer), GFP_KERNEL);
Expand Down

0 comments on commit d10ee9c

Please sign in to comment.