diff options
| author | Lars-Peter Clausen <lars@metafoo.de> | 2014-03-12 11:34:39 +0400 |
|---|---|---|
| committer | Mark Brown <broonie@linaro.org> | 2014-03-12 16:06:57 +0400 |
| commit | 5c1d5f091dc39eecf9a34a8be01492d14c23ad91 (patch) | |
| tree | f7ef44547a9cfb96e7ec0053d39fd0f14aef2527 /sound | |
| parent | 1438c2f60ba955114cff3717f1a334878c7886a9 (diff) | |
| download | linux-5c1d5f091dc39eecf9a34a8be01492d14c23ad91.tar.xz | |
ASoC: Fix use after free
Freeing the current list element while iterating over the list will cause a use
after free since the iterator function will still use the current element to
look up the next. Use list_for_each_safe() and remove the element from the list
before freeing it to avoid this.
Fixes: 1438c2f60b ("ASoC: Add a per component dai list")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/soc-core.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index f34f1a01fce1..a78bba4d52fb 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -3913,11 +3913,12 @@ static inline char *fmt_multiple_name(struct device *dev, */ static void snd_soc_unregister_dais(struct snd_soc_component *component) { - struct snd_soc_dai *dai; + struct snd_soc_dai *dai, *_dai; - list_for_each_entry(dai, &component->dai_list, list) { + list_for_each_entry_safe(dai, _dai, &component->dai_list, list) { dev_dbg(component->dev, "ASoC: Unregistered DAI '%s'\n", dai->name); + list_del(&dai->list); kfree(dai->name); kfree(dai); } |