diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2017-02-15 02:15:44 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-02-16 10:19:45 -0800 |
| commit | f5e2199ae574245b56b32e047c93625a28fe3b3a (patch) | |
| tree | 14623709c9fba398bf616e7487965abf5373fa1e | |
| parent | 021fbaa5fb5b2f0c2d9938ee16c79358ba9bf06b (diff) | |
staging: bcm2835-audio: allocate enough data for work queues
We accidentally allocate sizeof(void *) bytes instead of 112 bytes. It
results in memory corruption.
Fixes: 23b028c871e1 ("staging: bcm2835-audio: initial staging submission")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/bcm2835-audio/bcm2835-vchiq.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/drivers/staging/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/bcm2835-audio/bcm2835-vchiq.c index af0cd0b36bc5..fa23a13f8d95 100644 --- a/drivers/staging/bcm2835-audio/bcm2835-vchiq.c +++ b/drivers/staging/bcm2835-audio/bcm2835-vchiq.c @@ -135,8 +135,9 @@ int bcm2835_audio_start(struct bcm2835_alsa_stream *alsa_stream) LOG_DBG(" .. IN\n"); if (alsa_stream->my_wq) { - struct bcm2835_audio_work *work = - kmalloc(sizeof(struct bcm2835_audio_work *), GFP_ATOMIC); + struct bcm2835_audio_work *work; + + work = kmalloc(sizeof(*work), GFP_ATOMIC); /*--- Queue some work (item 1) ---*/ if (work) { INIT_WORK(&work->my_work, my_wq_function); @@ -157,8 +158,9 @@ int bcm2835_audio_stop(struct bcm2835_alsa_stream *alsa_stream) LOG_DBG(" .. IN\n"); if (alsa_stream->my_wq) { - struct bcm2835_audio_work *work = - kmalloc(sizeof(struct bcm2835_audio_work *), GFP_ATOMIC); + struct bcm2835_audio_work *work; + + work = kmalloc(sizeof(*work), GFP_ATOMIC); /*--- Queue some work (item 1) ---*/ if (work) { INIT_WORK(&work->my_work, my_wq_function); @@ -180,8 +182,9 @@ int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream, LOG_DBG(" .. IN\n"); if (alsa_stream->my_wq) { - struct bcm2835_audio_work *work = - kmalloc(sizeof(struct bcm2835_audio_work *), GFP_ATOMIC); + struct bcm2835_audio_work *work; + + work = kmalloc(sizeof(*work), GFP_ATOMIC); /*--- Queue some work (item 1) ---*/ if (work) { INIT_WORK(&work->my_work, my_wq_function); |