Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Chengfeng Ye <cyeaa@connect.ust.hk>
To:     perex@perex.cz, tiwai@suse.com
Cc:     alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org,
        Chengfeng Ye <cyeaa@connect.ust.hk>
Subject: [PATCH] sound/isa/gus: fix null pointer dereference on pointer block
Date:   Sun, 24 Oct 2021 03:46:11 -0700
Message-Id: <20211024104611.9919-1-cyeaa@connect.ust.hk>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?WwLpxYRfGCkOceagcLi6xw+1Des1NGal02Qo+AweNfxmeGekojHVGPM8LfYG?=
 =?us-ascii?Q?t4/Otvyd6XO7wIBfDyVpVgmPULWnX0MXYAM98JYRNCXDtxPtgTs68h76m1u2?=
 =?us-ascii?Q?vifUv8N79AUJalOKz1/AUulCkjB99yCjBXiqVHbGyabFgwCdfNbO9lpaAMNi?=
 =?us-ascii?Q?beGNLBC2EMmqwtAoTBsxCwBjpmMoH+gi/G1plUzpr7BnNlqKfe5I7yDSPXix?=
 =?us-ascii?Q?vnv3zb8tdwEU0b2nkNjI7kjP2XjNbvsibOXkoYxPXb+aklC6/kB4CEfBfAMn?=
 =?us-ascii?Q?XAmOVdENwGc0KJCBTkNM/ciI2+FUfJiH85iV3P935Ws6N19vVOpLf9stJgCw?=
 =?us-ascii?Q?B0wXQtE+H7VJFuMRm/HsJI4HdcyVnJLnK3ZoCScTILx3EIFcXxOoo+2rz+ET?=
 =?us-ascii?Q?w3ZdhYlXZ/GTTtSas7Qaq13hkjTK654TL8b6QMdXwBhpcUDNp4UpNTlvtNzR?=
 =?us-ascii?Q?q0/8u8QyJ6ZzgJk5FS+Nd6alRuJtUAasD8mXpwzWv3VYzNHEzL13dZ3eECQy?=
 =?us-ascii?Q?3sZgAJ+Ii4JZ9Jr76Xk2dgF4wI+AJ6fjPmlkcA4m35l09Nux+VP5tDYCYslB?=
 =?us-ascii?Q?FzsvIqrCP1XFqTrTyl2g7/f6GBL+vTD/Tq4OGg2PN2bb6btdDFhYs6xWPirN?=
 =?us-ascii?Q?tUJ/NXKQbJG5DXRpbUD6f1YUpsc4xFwHgjmfoww1r34E895+J7vqHgHyWRLG?=
 =?us-ascii?Q?zQWv2SAyPvLSGak2IXs10CYi3xb9JcJno1jY5/z6LhWonp9j4G1C+gtu/eM8?=
 =?us-ascii?Q?K9JyfobPMlYG/6AbtBmW/A5DFPaEH5K2R4TwUjfZ2OrrOoQ6Gy967rGRFnqN?=
 =?us-ascii?Q?c1szqIVNjlXmQA2FHHykx6UfkFr1uQxxxIWlYPmOkkQ/Sj8OA7GQZtVbCi+W?=
 =?us-ascii?Q?oMD7UFkw9IoNs3Mum2yF+gPd+jGDgEoDUn8PBaXVau0oogWIFvpJA6suFI7m?=
 =?us-ascii?Q?c/s4lXNun1LTeWVxgmxL+tYT0Ogg3MKTokORJGsNWEkR36bp9Er7qA3bBcgn?=
 =?us-ascii?Q?L+R+O/PZ1VUD6JVau6h8vUoBCe6Db2OqbIRVZFLtAJnYUHunVEOg5Qjd3m6A?=
 =?us-ascii?Q?Lz3PUk9qfEzWHz8Dhu0dY12jxtl74R9MMZHkj9idySwqL38gENcLW75DaDhU?=
 =?us-ascii?Q?+91r75AdEdwu6SrMvttZv4mveyEM6evIiAOwA7Bz+honoIUk0hd2ycbdyJMw?=
 =?us-ascii?Q?odCU4gILaLl/g3NEyCdW9v2qJjGVPz+1hrVa2n9PKFSRVftIiSzXw5amNbrn?=
 =?us-ascii?Q?SilgCtWYrxtqfuuyptpUKPUoMvrOKqEPm2DSBJpSSPKKNW4WKIIctIDoH8W4?=
 =?us-ascii?Q?j7auB7eLpKiuPd+3ArICMFQJYDHoDmSfG/XfVqQiQev71IG4oUag5PjvWJE2?=
 =?us-ascii?Q?pudeKaregwRgh1yTVZG+cav8hmKzpc43ISJ2EupGrtULumQfVQzbkAHG7Zc6?=
 =?us-ascii?Q?vmyiBj9+EEZQfJzLCS2MTyMbb6MzdDcugRXBGRlOt6YTfz8yw3QEGT/Nx1UM?=
 =?us-ascii?Q?q9wvNxAhTxrQ/PfDrc2j4lyxLHNlNraMI9/96vzYP+PmWi31NfnPliXw+Cb3?=
 =?us-ascii?Q?faoZmh+RcPxpnSm6MojR0AGSl8SfJvHU3SfDOI1t2fSKtY8bxfiVU/q3d7fn?=
 =?us-ascii?Q?ptrRJ7zuFr/PDf1p8auGMiM=3D?=
X-OriginatorOrg: connect.ust.hk
X-MS-Exchange-CrossTenant-Network-Message-Id: 5954bbb8-661b-4488-d946-08d996db8d06
X-MS-Exchange-CrossTenant-AuthSource: TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Oct 2021 10:46:36.0314
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 6c1d4152-39d0-44ca-88d9-b8d6ddca0708
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: wdg7IOCTq+Gl6FkeXDiPfgEe2mpXF2tnWtTndboCL0WYK5ptuE9e0DDwlqwJ2dEwznKTfDsWnFB4VoKARihDmA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYAP286MB0121
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The pointer block return from snd_gf1_dma_next_block could be
null, so there is a potential null pointer dereference issue.
Fix this by adding a null check before dereference.

Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
 sound/isa/gus/gus_dma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/isa/gus/gus_dma.c b/sound/isa/gus/gus_dma.c
index a1c770d826dd..6d664dd8dde0 100644
--- a/sound/isa/gus/gus_dma.c
+++ b/sound/isa/gus/gus_dma.c
@@ -126,6 +126,8 @@ static void snd_gf1_dma_interrupt(struct snd_gus_card * gus)
 	}
 	block = snd_gf1_dma_next_block(gus);
 	spin_unlock(&gus->dma_lock);
+	if (!block)
+		return;
 	snd_gf1_dma_program(gus, block->addr, block->buf_addr, block->count, (unsigned short) block->cmd);
 	kfree(block);
 #if 0
-- 
2.17.1