[PATCH 2/2] ASoC: core: Fix possible NULL pointer dereference

From: Tushar Behera
Date: Fri Jul 04 2014 - 04:56:50 EST


snd_soc_of_parse_card_name() may be called before card->dev has been
set, which results in a kernel panic.

Unable to handle kernel NULL pointer dereference at virtual address 00000210
PC is at snd_soc_of_parse_card_name+0x18/0x54
LR is at snow_probe+0x5c/0xd4

Add an error check in snd_soc_of_parse_card_name() to take care of this
case and print out a message in case of error.

Signed-off-by: Tushar Behera <tushar.b@xxxxxxxxxxx>
---
sound/soc/soc-core.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index c4db07f..2e4bdc0 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -4391,9 +4391,16 @@ EXPORT_SYMBOL_GPL(snd_soc_unregister_codec);
int snd_soc_of_parse_card_name(struct snd_soc_card *card,
const char *propname)
{
- struct device_node *np = card->dev->of_node;
+ struct device_node *np;
int ret;

+ if (!card->dev) {
+ pr_err("card->dev is not set before calling %s\n", __func__);
+ return -EINVAL;
+ }
+
+ np = card->dev->of_node;
+
ret = of_property_read_string_index(np, propname, 0, &card->name);
/*
* EINVAL means the property does not exist. This is fine providing
--
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/