[alsa-devel] [PATCH 0/6] Small fixes for bugs Coverity reported
Hi,
here is a series of small fixes for bugs reported by Coverity. The first one for 6fire is a real bad one, but I guess it hits little users just because of the number of users for such cases.
Others are just minor fixes and code improvements in HD-audio and core codes.
Takashi
The probe code of snd-usb-6fire driver overrides the devices[] pointer wrongly without checking whether it's already occupied or not. This would screw up the device disconnection later.
Spotted by coverity CID 141423.
Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/usb/6fire/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c index c39c779..66edc4a 100644 --- a/sound/usb/6fire/chip.c +++ b/sound/usb/6fire/chip.c @@ -101,7 +101,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, usb_set_intfdata(intf, chips[i]); mutex_unlock(®ister_mutex); return 0; - } else if (regidx < 0) + } else if (!devices[i] && regidx < 0) regidx = i; } if (regidx < 0) {
Fix a possible NULL access of indexp in fill_audio_out_name() called from snd_hda_get_pin_label().
Spotted by coverity CID 402035.
Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/pci/hda/hda_auto_parser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c index 48a9d00..853c6a6 100644 --- a/sound/pci/hda/hda_auto_parser.c +++ b/sound/pci/hda/hda_auto_parser.c @@ -638,7 +638,7 @@ static int fill_audio_out_name(struct hda_codec *codec, hda_nid_t nid, /* don't add channel suffix for Headphone controls */ int idx = get_hp_label_index(codec, nid, cfg->hp_pins, cfg->hp_outs); - if (idx >= 0) + if (idx >= 0 && indexp) *indexp = idx; sfx = ""; }
... to improve the readability.
Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/pci/hda/hda_beep.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/hda_beep.c b/sound/pci/hda/hda_beep.c index 20d065a..98bce98 100644 --- a/sound/pci/hda/hda_beep.c +++ b/sound/pci/hda/hda_beep.c @@ -110,6 +110,7 @@ static int snd_hda_beep_event(struct input_dev *dev, unsigned int type, case SND_BELL: if (hz) hz = 1000; + /* fallthru */ case SND_TONE: if (beep->linear_tone) beep->tone = beep_linear_tone(beep, hz);
Reported by coverity.
Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/pci/hda/hda_codec.c | 3 +-- sound/pci/hda/patch_realtek.c | 2 -- 2 files changed, 1 insertion(+), 4 deletions(-)
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 0faab3b..de1a767 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -2634,8 +2634,7 @@ static int map_slaves(struct hda_codec *codec, const char * const *slaves, items = codec->mixers.list; for (i = 0; i < codec->mixers.used; i++) { struct snd_kcontrol *sctl = items[i].kctl; - if (!sctl || !sctl->id.name || - sctl->id.iface != SNDRV_CTL_ELEM_IFACE_MIXER) + if (!sctl || sctl->id.iface != SNDRV_CTL_ELEM_IFACE_MIXER) continue; for (s = slaves; *s; s++) { char tmpname[sizeof(sctl->id.name)]; diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 1f0a040..8947035 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -554,8 +554,6 @@ do_sku: nid = portd; else if (tmp == 3) nid = porti; - else - return 1; if (found_in_nid_list(nid, spec->gen.autocfg.line_out_pins, spec->gen.autocfg.line_outs)) return 1;
Just to improve readability. Spotted by coverity CID 115002 and 115003.
Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/core/pcm_native.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index b71be57..01a5e05 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -2428,6 +2428,7 @@ static int snd_pcm_hwsync(struct snd_pcm_substream *substream) case SNDRV_PCM_STATE_DRAINING: if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) goto __badfd; + /* Fall through */ case SNDRV_PCM_STATE_RUNNING: if ((err = snd_pcm_update_hw_ptr(substream)) < 0) break; @@ -2460,6 +2461,7 @@ static int snd_pcm_delay(struct snd_pcm_substream *substream, case SNDRV_PCM_STATE_DRAINING: if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) goto __badfd; + /* Fall through */ case SNDRV_PCM_STATE_RUNNING: if ((err = snd_pcm_update_hw_ptr(substream)) < 0) break;
module->name is a fixed array, so we can check the empty contents straightforwardly in module_slot_match().
Spotted by coverity CID 1056786.
Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/core/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/core/init.c b/sound/core/init.c index 6b90871..01a8938 100644 --- a/sound/core/init.c +++ b/sound/core/init.c @@ -66,7 +66,7 @@ static int module_slot_match(struct module *module, int idx) #ifdef MODULE const char *s1, *s2;
- if (!module || !module->name || !slots[idx]) + if (!module || !*module->name || !slots[idx]) return 0;
s1 = module->name;
participants (1)
-
Takashi Iwai