瀏覽代碼

ASoC: soc-cache: Fix memory overflow in LZO initialization

The bitmap_zero() nbits argument was improperly set to reg_size
but the underlying buffer was bmp_size long.  This caused the memset
to zero past the end of the allocated buffer and into the kernel heap
causing strange kernel crashes sometimes by overwriting critical
kernel structures.

Signed-off-by: Dimitris Papastamos <dp@opensource.wolfsonmicro.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Dimitris Papastamos 14 年之前
父節點
當前提交
09c74a9d0b
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      sound/soc/soc-cache.c

+ 1 - 1
sound/soc/soc-cache.c

@@ -1348,7 +1348,7 @@ static int snd_soc_lzo_cache_init(struct snd_soc_codec *codec)
 		ret = -ENOMEM;
 		goto err;
 	}
-	bitmap_zero(sync_bmp, reg_size);
+	bitmap_zero(sync_bmp, bmp_size);
 
 	/* allocate the lzo blocks and initialize them */
 	for (i = 0; i < blkcount; ++i) {