Unverified Commit 0bce512e authored May 24, 2019 by Pierre-Louis Bossart Committed by Mark Brown May 28, 2019

ASoC: SOF: core: fix error handling with the probe workqueue

In some configurations, it's a requirement to split the probe in two,
with a second part handled in a workqueue (e.g. for HDMI support
which depends on the DRM modules).

SOF already handles these configurations but the error flow is
incorrect. When an error occurs in the workqueue, the probe has
technically already completed. If we release the resources on errors,
this generates kernel oops/use-after-free when the resources are
released a second time on module removal.

GitHub issue: https://github.com/thesofproject/linux/issues/945


Fixes: c16211d6 ("ASoC: SOF: Add Sound Open Firmware driver core")
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>

parent 13931ae3

sound/soc/sof/core.c

+16 −0

Original line number	Diff line number	Diff line
		@@ -393,6 +393,7 @@ static int sof_probe_continue(struct snd_sof_dev *sdev)

		return 0;

		#if !IS_ENABLED(CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE)
		fw_run_err:
		snd_sof_fw_unload(sdev);
		fw_load_err:
		@@ -401,6 +402,21 @@ ipc_err:
		snd_sof_free_debug(sdev);
		dbg_err:
		snd_sof_remove(sdev);
		#else

		/*
		* when the probe_continue is handled in a work queue, the
		* probe does not fail so we don't release resources here.
		* They will be released with an explicit call to
		* snd_sof_device_remove() when the PCI/ACPI device is removed
		*/

		fw_run_err:
		fw_load_err:
		ipc_err:
		dbg_err:

		#endif

		return ret;
		}

Admin message