From a5c9b052e9f4cfc5d9ce7f8073393f5c20db4771 Mon Sep 17 00:00:00 2001 From: Guennadi Liakhovetski Date: Thu, 20 Sep 2018 15:42:14 +0200 Subject: [PATCH] soc: fix a use after free case Unloading ASoC modules as used by the SOF driver leads to an object being used after it's been freed. Fix this be clearing a reference to it and making sure to check for its presence. This fixes issue #144. Signed-off-by: Guennadi Liakhovetski (cherry picked from commit 057637349447338e7eeb289921380cd7011b84c9) --- sound/soc/soc-core.c | 2 +- sound/soc/soc-topology.c | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index 448e5322fe3c92..fd036c55a49f72 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -951,7 +951,7 @@ static void soc_remove_dai(struct snd_soc_dai *dai, int order) { int err; - if (!dai || !dai->probed || + if (!dai || !dai->probed || !dai->driver || dai->driver->remove_order != order) return; diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c index b78cf0d09e28a0..e4ae7a12614c4f 100644 --- a/sound/soc/soc-topology.c +++ b/sound/soc/soc-topology.c @@ -503,6 +503,7 @@ static void remove_dai(struct snd_soc_component *comp, { struct snd_soc_dai_driver *dai_drv = container_of(dobj, struct snd_soc_dai_driver, dobj); + struct snd_soc_dai *dai; if (pass != SOC_TPLG_PASS_PCM_DAI) return; @@ -510,6 +511,10 @@ static void remove_dai(struct snd_soc_component *comp, if (dobj->ops && dobj->ops->dai_unload) dobj->ops->dai_unload(comp, dobj); + list_for_each_entry(dai, &comp->dai_list, list) + if (dai->driver == dai_drv) + dai->driver = NULL; + kfree(dai_drv->name); list_del(&dobj->list); kfree(dai_drv);