summaryrefslogtreecommitdiffstats
path: root/sound
diff options
context:
space:
mode:
authorGuennadi Liakhovetski <guennadi.liakhovetski@intel.com>2019-02-01 11:05:13 -0600
committerMark Brown <broonie@kernel.org>2019-02-02 17:13:28 +0100
commit52abe6cc1866ac3d54612f5d80563e6608c0ddfc (patch)
treee003e0a1cc378513a2a3cfc505f373a40d42b069 /sound
parent7aea8a9d71d54f449f49e20324df06341cc18395 (diff)
downloadlinux-stable-52abe6cc1866ac3d54612f5d80563e6608c0ddfc.tar.gz
linux-stable-52abe6cc1866ac3d54612f5d80563e6608c0ddfc.tar.bz2
linux-stable-52abe6cc1866ac3d54612f5d80563e6608c0ddfc.zip
ASoC: topology: fix oops/use-after-free case with dai driver
rmmod/modprobe tests expose a kernel oops when accessing the dai driver pointer. This comes from the topology design which operates in multiple passes. Each object removal happens at a specific iteration, and the code checks for the iteration (order) number after the memory containing the order was freed. Fix this be clearing a reference to the dai driver and check its validity to avoid dereferences. Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@intel.com> Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound')
-rw-r--r--sound/soc/soc-core.c2
-rw-r--r--sound/soc/soc-topology.c5
2 files changed, 6 insertions, 1 deletions
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index ea16c2b199ce..50617db05c46 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -956,7 +956,7 @@ static void soc_remove_dai(struct snd_soc_dai *dai, int order)
{
int err;
- if (!dai || !dai->probed ||
+ if (!dai || !dai->probed || !dai->driver ||
dai->driver->remove_order != order)
return;
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 045ef136903d..fc79ec6927e3 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -502,6 +502,7 @@ static void remove_dai(struct snd_soc_component *comp,
{
struct snd_soc_dai_driver *dai_drv =
container_of(dobj, struct snd_soc_dai_driver, dobj);
+ struct snd_soc_dai *dai;
if (pass != SOC_TPLG_PASS_PCM_DAI)
return;
@@ -509,6 +510,10 @@ static void remove_dai(struct snd_soc_component *comp,
if (dobj->ops && dobj->ops->dai_unload)
dobj->ops->dai_unload(comp, dobj);
+ list_for_each_entry(dai, &comp->dai_list, list)
+ if (dai->driver == dai_drv)
+ dai->driver = NULL;
+
kfree(dai_drv->name);
list_del(&dobj->list);
kfree(dai_drv);