diff options
| author | Guennadi Liakhovetski <guennadi.liakhovetski@intel.com> | 2019-02-01 20:05:13 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2019-02-02 19:13:28 +0300 |
| commit | 52abe6cc1866ac3d54612f5d80563e6608c0ddfc (patch) | |
| tree | e003e0a1cc378513a2a3cfc505f373a40d42b069 /sound/soc/soc-topology.c | |
| parent | 7aea8a9d71d54f449f49e20324df06341cc18395 (diff) | |
| download | linux-52abe6cc1866ac3d54612f5d80563e6608c0ddfc.tar.xz | |
ASoC: topology: fix oops/use-after-free case with dai driver
rmmod/modprobe tests expose a kernel oops when accessing the dai
driver pointer. This comes from the topology design which operates in
multiple passes. Each object removal happens at a specific iteration,
and the code checks for the iteration (order) number after the memory
containing the order was freed.
Fix this be clearing a reference to the dai driver and check its
validity to avoid dereferences.
Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound/soc/soc-topology.c')
| -rw-r--r-- | sound/soc/soc-topology.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c index 045ef136903d..fc79ec6927e3 100644 --- a/sound/soc/soc-topology.c +++ b/sound/soc/soc-topology.c @@ -502,6 +502,7 @@ static void remove_dai(struct snd_soc_component *comp, { struct snd_soc_dai_driver *dai_drv = container_of(dobj, struct snd_soc_dai_driver, dobj); + struct snd_soc_dai *dai; if (pass != SOC_TPLG_PASS_PCM_DAI) return; @@ -509,6 +510,10 @@ static void remove_dai(struct snd_soc_component *comp, if (dobj->ops && dobj->ops->dai_unload) dobj->ops->dai_unload(comp, dobj); + list_for_each_entry(dai, &comp->dai_list, list) + if (dai->driver == dai_drv) + dai->driver = NULL; + kfree(dai_drv->name); list_del(&dobj->list); kfree(dai_drv); |