ASoC: Fix use-after-free at card unregistration (4efda5f2) · Commits · 戴 / test

soc_cleanup_card_resources() call snd_card_free() at the last of its procedure. This turned out to lead to a use-after-free. PCM runtimes have been already removed via soc_remove_pcm_runtimes(), while it's dereferenced later in soc_pcm_free() called via snd_card_free(). The fix is simple: just move the snd_card_free() call to the beginning of the whole procedure. This also gives another benefit: it guarantees that all operations have been shut down before actually releasing the resources, which was racy until now. Reported-and-tested-by:

Robert Jarzmik <robert.jarzmik@free.fr> Signed-off-by:

Takashi Iwai <tiwai@suse.de> Signed-off-by:

Mark Brown <broonie@kernel.org> Cc: <stable@vger.kernel.org>

sound/soc/soc-core.c

+3 −2

Original line number	Original line	Diff line number	Diff line
	@@ -2286,6 +2286,9 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card)
	list_for_each_entry(rtd, &card->rtd_list, list)		list_for_each_entry(rtd, &card->rtd_list, list)
	flush_delayed_work(&rtd->delayed_work);		flush_delayed_work(&rtd->delayed_work);

			/* free the ALSA card at first; this syncs with pending operations */
			snd_card_free(card->snd_card);

	/* remove and free each DAI */		/* remove and free each DAI */
	soc_remove_dai_links(card);		soc_remove_dai_links(card);
	soc_remove_pcm_runtimes(card);		soc_remove_pcm_runtimes(card);
	@@ -2300,9 +2303,7 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card)
	if (card->remove)		if (card->remove)
	card->remove(card);		card->remove(card);

	snd_card_free(card->snd_card);
	return 0;		return 0;

	}		}

	/* removes a socdev */		/* removes a socdev */

Admin message