2014-12-23 09:10:13

by Qais Yousef

[permalink] [raw]
Subject: [PATCH] ALSA: ASoC: soc-compress.c: fix NULL dereference

In soc_new_compress() when rtd->dai_link->daynmic is set, we create the pcm
substreams with this call:

ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num,
1, 0, &be_pcm);

which passes 0 as capture_count leading to

be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream

being NULL, hence when trying to set rtd a few lines below we get an oops.
Fix by removing this line of code since CAPTURE substream will always be NULL.

Signed-off-by: Qais Yousef <[email protected]>
Cc: Vinod Koul <[email protected]>
Cc: Liam Girdwood <[email protected]>
Cc: Mark Brown <[email protected]>
Cc: Jaroslav Kysela <[email protected]>
Cc: Takashi Iwai <[email protected]>
Cc: [email protected]
---
Not sure if this is the correct fix but that's what I could come up with my
limited knowledge.

I think the more correct solution would be to use the value of
rtd->dai_link->dpcm_playback and rtd->dai_link->dpcm_capture in the args of
snd_pcm_new_internal() for playback_count and capture_count.

sound/soc/soc-compress.c | 1 -
1 file changed, 1 deletion(-)

diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index 590a82f01d0b..7ab39f65384c 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -669,7 +669,6 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
rtd->pcm = be_pcm;
rtd->fe_compr = 1;
be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
- be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops));
} else
memcpy(compr->ops, &soc_compr_ops, sizeof(soc_compr_ops));
--
2.1.0


2014-12-29 16:13:33

by Mark Brown

[permalink] [raw]
Subject: Re: [PATCH] ALSA: ASoC: soc-compress.c: fix NULL dereference

On Tue, Dec 23, 2014 at 09:09:27AM +0000, Qais Yousef wrote:
> In soc_new_compress() when rtd->dai_link->daynmic is set, we create the pcm
> substreams with this call:
>
> ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num,
> 1, 0, &be_pcm);
>
> which passes 0 as capture_count leading to
>
> be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream
>
> being NULL, hence when trying to set rtd a few lines below we get an oops.
> Fix by removing this line of code since CAPTURE substream will always be NULL.

Why will the capture stream always be NULL? There should be no
intrinsic reason why we can't have hardware support for capturing
compressed audio.


Attachments:
(No filename) (710.00 B)
signature.asc (473.00 B)
Digital signature
Download all attachments