ASoC: topology: fix oops/use-after-free case with dai driver (52abe6cc) · Commits · 戴 / test

rmmod/modprobe tests expose a kernel oops when accessing the dai driver pointer. This comes from the topology design which operates in multiple passes. Each object removal happens at a specific iteration, and the code checks for the iteration (order) number after the memory containing the order was freed. Fix this be clearing a reference to the dai driver and check its validity to avoid dereferences. Signed-off-by:

Guennadi Liakhovetski <guennadi.liakhovetski@intel.com> Signed-off-by:

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Signed-off-by:

Mark Brown <broonie@kernel.org>

sound/soc/soc-core.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -956,7 +956,7 @@ static void soc_remove_dai(struct snd_soc_dai *dai, int order)
		{
		int err;

		if (!dai \|\| !dai->probed \|\|
		if (!dai \|\| !dai->probed \|\| !dai->driver \|\|
		dai->driver->remove_order != order)
		return;

sound/soc/soc-topology.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -502,6 +502,7 @@ static void remove_dai(struct snd_soc_component *comp,
		{
		struct snd_soc_dai_driver *dai_drv =
		container_of(dobj, struct snd_soc_dai_driver, dobj);
		struct snd_soc_dai *dai;

		if (pass != SOC_TPLG_PASS_PCM_DAI)
		return;
		@@ -509,6 +510,10 @@ static void remove_dai(struct snd_soc_component *comp,
		if (dobj->ops && dobj->ops->dai_unload)
		dobj->ops->dai_unload(comp, dobj);

		list_for_each_entry(dai, &comp->dai_list, list)
		if (dai->driver == dai_drv)
		dai->driver = NULL;

		kfree(dai_drv->name);
		list_del(&dobj->list);
		kfree(dai_drv);

Admin message