Commit 550b349a authored by Dan Carpenter's avatar Dan Carpenter Committed by Mark Brown
Browse files

ASoC: Intel: Skylake: Fix a couple user after free bugs 



We need to use the _safe() version of list_for_each_entry() here because
of the kfree(modules).

Fixes: b8c722dd ("ASoC: Intel: Skylake: Add support for deferred DSP module bind")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent e6a33532

sound/soc/intel/skylake/skl-pcm.c

+2 −2
Original line number Diff line number Diff line
@@ -1323,10 +1323,10 @@ int skl_platform_unregister(struct device *dev) 
{

	struct hdac_ext_bus *ebus = dev_get_drvdata(dev);

	struct skl *skl = ebus_to_skl(ebus);

	struct skl_module_deferred_bind *modules;

	struct skl_module_deferred_bind *modules, *tmp;



	if (!list_empty(&skl->bind_list)) {

		list_for_each_entry(modules, &skl->bind_list, node) {

		list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) {

			list_del(&modules->node);

			kfree(modules);

		}

sound/soc/intel/skylake/skl-topology.c

+2 −2
Original line number Diff line number Diff line
@@ -1091,7 +1091,7 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w, 
	struct skl_module_cfg *src_module = NULL, *dst_module;

	struct skl_sst *ctx = skl->skl_sst;

	struct skl_pipe *s_pipe = mconfig->pipe;

	struct skl_module_deferred_bind *modules;

	struct skl_module_deferred_bind *modules, *tmp;



	if (s_pipe->state == SKL_PIPE_INVALID)

		return -EINVAL;
@@ -1105,7 +1105,7 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w, 


		src_module = w_module->w->priv;



		list_for_each_entry(modules, &skl->bind_list, node) {

		list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) {

			/*

			 * When the destination module is deleted, Unbind the

			 * modules from deferred bind list.

CRA Git | Maintained and supported by SUSTech CRA and CCSE