diff options
| author | Takashi Iwai <tiwai@suse.de> | 2020-01-07 10:09:56 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2020-01-08 01:27:44 +0300 |
| commit | 8e3366cad2bfe4e669bfd3758110be90b1dc75aa (patch) | |
| tree | efc5b85d712fd313266e450691b1cf587ffa5606 /sound/soc/soc-component.c | |
| parent | 869bced7a055665e3ddb1ba671a441ce6f997bf1 (diff) | |
| download | linux-8e3366cad2bfe4e669bfd3758110be90b1dc75aa.tar.xz | |
ASoC: Fix NULL dereference at freeing
When an ASoC driver with pcm_destruct component ops is freed before
the PCM object instantiation (e.g. deferring the probe), it hits an
Oops at snd_soc_pcm_component_free() that calls the pcm_destruct ops
unconditionally.
Fix it by adding a NULL-check of rtd->pcm before calling callbacks.
Fixes: c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcm_destruct")
Reported-by: Matthias Brugger <matthias.bgg@gmail.com>
Tested-by: Ben Ho <ben.ho@mediatek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20200107070956.15807-1-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound/soc/soc-component.c')
| -rw-r--r-- | sound/soc/soc-component.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sound/soc/soc-component.c b/sound/soc/soc-component.c index 1590e805d016..6a8f26bf09ba 100644 --- a/sound/soc/soc-component.c +++ b/sound/soc/soc-component.c @@ -520,6 +520,9 @@ void snd_soc_pcm_component_free(struct snd_soc_pcm_runtime *rtd) struct snd_soc_rtdcom_list *rtdcom; struct snd_soc_component *component; + if (!rtd->pcm) + return; + for_each_rtd_components(rtd, rtdcom, component) if (component->driver->pcm_destruct) component->driver->pcm_destruct(component, rtd->pcm); |