* [PATCH] ASoC: Intel: Skylake: fix invalid memory access due to wrong reference of pointer
@ 2017-02-24 2:48 Takashi Sakamoto
2017-03-02 8:56 ` [alsa-devel] " Vinod Koul
0 siblings, 1 reply; 2+ messages in thread
From: Takashi Sakamoto @ 2017-02-24 2:48 UTC (permalink / raw)
To: broonie, jeeja.kp, shreyas.nc
Cc: alsa-devel, ichiro.suzuki, yukie.kato, hirotaka.furukawa,
ryotaro.shibata, Takashi Sakamoto, # v4 . 5+
In 'skl_tplg_set_module_init_data()', a pointer to 'params' member of
'struct skl_algo_data' is calculated, then casted to (u32 *) and assigned
to a member of configuration data. The configuration data is passed to the
other functions and used to process intel IPC. In this processing, the
value of member is used to get message data, however this can bring invalid
memory access in 'skl_set_module_params()' as a result of calculation of
a pointer for actual message data.
(sound/soc/intel/skylake/skl-topology.c)
skl_tplg_init_pipe_modules()
->skl_tplg_set_module_init_data() (has this bug)
->skl_tplg_set_module_params()
(sound/soc/intel/skylake/skl-messages.c)
->skl_set_module_params()
((char *)param) + data_offset
This commit fixes the bug.
Cc: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Cc: <stable@vger.kernel.org> # v4.5+
Fixes: abb740033b56 ("ASoC: Intel: Skylake: Add support to configure module params")
Signed-off-by: Takashi Sakamoto <takashi.sakamoto@miraclelinux.com>
---
sound/soc/intel/skylake/skl-topology.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index ed58b5b..2dbfb1b 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -512,7 +512,7 @@ static int skl_tplg_set_module_init_data(struct snd_soc_dapm_widget *w)
if (bc->set_params != SKL_PARAM_INIT)
continue;
- mconfig->formats_config.caps = (u32 *)&bc->params;
+ mconfig->formats_config.caps = (u32 *)bc->params;
mconfig->formats_config.caps_size = bc->size;
break;
--
2.9.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [alsa-devel] [PATCH] ASoC: Intel: Skylake: fix invalid memory access due to wrong reference of pointer
2017-02-24 2:48 [PATCH] ASoC: Intel: Skylake: fix invalid memory access due to wrong reference of pointer Takashi Sakamoto
@ 2017-03-02 8:56 ` Vinod Koul
0 siblings, 0 replies; 2+ messages in thread
From: Vinod Koul @ 2017-03-02 8:56 UTC (permalink / raw)
To: Takashi Sakamoto
Cc: broonie, jeeja.kp, shreyas.nc, alsa-devel, hirotaka.furukawa,
ichiro.suzuki, ryotaro.shibata, # v4 . 5+, Takashi Sakamoto,
yukie.kato
On Fri, Feb 24, 2017 at 11:48:41AM +0900, Takashi Sakamoto wrote:
> In 'skl_tplg_set_module_init_data()', a pointer to 'params' member of
> 'struct skl_algo_data' is calculated, then casted to (u32 *) and assigned
> to a member of configuration data. The configuration data is passed to the
> other functions and used to process intel IPC. In this processing, the
> value of member is used to get message data, however this can bring invalid
> memory access in 'skl_set_module_params()' as a result of calculation of
> a pointer for actual message data.
>
> (sound/soc/intel/skylake/skl-topology.c)
> skl_tplg_init_pipe_modules()
> ->skl_tplg_set_module_init_data() (has this bug)
> ->skl_tplg_set_module_params()
> (sound/soc/intel/skylake/skl-messages.c)
> ->skl_set_module_params()
> ((char *)param) + data_offset
>
> This commit fixes the bug.
Thanks Takashi San for the fix
Acked-by: Vinod Koul <vinod.koul@intel.com>
--
~Vinod
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-03-02 9:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-02-24 2:48 [PATCH] ASoC: Intel: Skylake: fix invalid memory access due to wrong reference of pointer Takashi Sakamoto
2017-03-02 8:56 ` [alsa-devel] " Vinod Koul
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox