ASoC: soc-cache: Fix memory overflow in LZO initialization
The bitmap_zero() nbits argument was improperly set to reg_size
but the underlying buffer was bmp_size long. This caused the memset
to zero past the end of the allocated buffer and into the kernel heap
causing strange kernel crashes sometimes by overwriting critical
kernel structures.
Signed-off-by: Dimitris Papastamos <dp@opensource.wolfsonmicro.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
diff --git a/sound/soc/soc-cache.c b/sound/soc/soc-cache.c
index 9b1ba33..5143984 100644
--- a/sound/soc/soc-cache.c
+++ b/sound/soc/soc-cache.c
@@ -1348,7 +1348,7 @@
ret = -ENOMEM;
goto err;
}
- bitmap_zero(sync_bmp, reg_size);
+ bitmap_zero(sync_bmp, bmp_size);
/* allocate the lzo blocks and initialize them */
for (i = 0; i < blkcount; ++i) {