diff options
| author | Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> | 2019-02-01 20:05:12 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2019-02-02 19:13:09 +0300 |
| commit | 199ed3e81c49a621ce6fcb630ab9f30d92db6718 (patch) | |
| tree | 9b0e819eddbf9869c13923d475a7d8aa78ecac81 /include/sound/soc-dapm.h | |
| parent | 4bd8597dc36c376a2bb1ef2c72984615bdeb68de (diff) | |
| download | linux-199ed3e81c49a621ce6fcb630ab9f30d92db6718.tar.xz | |
ASoC: dapm: fix use-after-free issue with dailink sname
Commit 7620fe9161ce ("ASoC: topology: fix memory leak in
soc_tplg_dapm_widget_create") fixed a memory leak issue, but
additional tests and KASAN reports show a use-after-free in soc-dapm.
The widgets are created with a kmemdup operating on a template. The
"name" string is also duplicated, but the "sname" string is not. As a
result, when the template is freed after widget creation, its sname
string is still used.
Fix by explicitly duplicating the "sname" string, and freeing it when
required.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'include/sound/soc-dapm.h')
0 files changed, 0 insertions, 0 deletions