public inbox for kernel-janitors@vger.kernel.org
 help / color / mirror / Atom feed
* [patch] staging: bcm2835-audio: allocate enough data for work queues
@ 2017-02-14 23:15 Dan Carpenter
  0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2017-02-14 23:15 UTC (permalink / raw)
  To: kernel-janitors

We accidentally allocate sizeof(void *) bytes instead of 112 bytes.  It
results in memory corruption.

Fixes: 23b028c871e1 ("staging: bcm2835-audio: initial staging submission")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/staging/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/bcm2835-audio/bcm2835-vchiq.c
index d11f2cdd1014..f5c6a83569f3 100644
--- a/drivers/staging/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/bcm2835-audio/bcm2835-vchiq.c
@@ -134,8 +134,9 @@ int bcm2835_audio_start(struct bcm2835_alsa_stream *alsa_stream)
 	int ret = -1;
 	LOG_DBG(" .. IN\n");
 	if (alsa_stream->my_wq) {
-		struct bcm2835_audio_work *work -			kmalloc(sizeof(struct bcm2835_audio_work *), GFP_ATOMIC);
+		struct bcm2835_audio_work *work;
+
+		work = kmalloc(sizeof(*work), GFP_ATOMIC);
 		/*--- Queue some work (item 1) ---*/
 		if (work) {
 			INIT_WORK(&work->my_work, my_wq_function);
@@ -155,8 +156,9 @@ int bcm2835_audio_stop(struct bcm2835_alsa_stream *alsa_stream)
 	int ret = -1;
 	LOG_DBG(" .. IN\n");
 	if (alsa_stream->my_wq) {
-		struct bcm2835_audio_work *work -			kmalloc(sizeof(struct bcm2835_audio_work *), GFP_ATOMIC);
+		struct bcm2835_audio_work *work;
+
+		work = kmalloc(sizeof(*work), GFP_ATOMIC);
 		/*--- Queue some work (item 1) ---*/
 		if (work) {
 			INIT_WORK(&work->my_work, my_wq_function);
@@ -177,8 +179,9 @@ int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream,
 	int ret = -1;
 	LOG_DBG(" .. IN\n");
 	if (alsa_stream->my_wq) {
-		struct bcm2835_audio_work *work -			kmalloc(sizeof(struct bcm2835_audio_work *), GFP_ATOMIC);
+		struct bcm2835_audio_work *work;
+
+		work = kmalloc(sizeof(*work), GFP_ATOMIC);
 		/*--- Queue some work (item 1) ---*/
 		if (work) {
 			INIT_WORK(&work->my_work, my_wq_function);

^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2017-02-14 23:15 UTC | newest]

Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-02-14 23:15 [patch] staging: bcm2835-audio: allocate enough data for work queues Dan Carpenter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox