From: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Date: Wed, 14 Mar 2018 20:42:40 +0000 (+0000)
Subject: ASoC: topology: Check widget kcontrols before deref.
X-Git-Tag: 4.17-rc1SMB3-Fixes~25^2~6^2~12^5
X-Git-Url: http://git.samba.org/samba.git/?p=sfrench%2Fcifs-2.6.git;a=commitdiff_plain;h=05bdcf12905533b8628627b6634608cd3b57c607

ASoC: topology: Check widget kcontrols before deref.

Validate the topology input before we dereference the pointer.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---

diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index e81b52600d58..b363f2409f72 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -504,6 +504,9 @@ static void remove_widget(struct snd_soc_component *comp,
 	if (dobj->ops && dobj->ops->widget_unload)
 		dobj->ops->widget_unload(comp, dobj);
 
+	if (!w->kcontrols)
+		goto free_news;
+
 	/*
 	 * Dynamic Widgets either have 1..N enum kcontrols or mixers.
 	 * The enum may either have an array of values or strings.
@@ -524,7 +527,6 @@ static void remove_widget(struct snd_soc_component *comp,
 
 			kfree(se);
 		}
-		kfree(w->kcontrol_news);
 	} else {
 		/* volume mixer or bytes controls */
 		for (i = 0; i < w->num_kcontrols; i++) {
@@ -541,8 +543,11 @@ static void remove_widget(struct snd_soc_component *comp,
 			kfree((void *)kcontrol->private_value);
 			snd_ctl_remove(card, kcontrol);
 		}
-		kfree(w->kcontrol_news);
 	}
+
+free_news:
+	kfree(w->kcontrol_news);
+
 	/* widget w is freed by soc-dapm.c */
 }