From f553a757970a64b04f1a9c95cfa45e0c5ae6b526 Mon Sep 17 00:00:00 2001 From: Guennadi Liakhovetski Date: Thu, 20 Sep 2018 15:42:14 +0200 Subject: [PATCH] soc: fix a use after free case Unloading ASoC modules as used by the SOF driver leads to an object being used after it's been freed. Fix this be clearing a reference to it and making sure to check for its presence. This fixes issue #144. Signed-off-by: Guennadi Liakhovetski --- sound/soc/soc-core.c | 6 +++--- sound/soc/soc-topology.c | 5 +++++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index 49e82131141f0a..fdbef0d89d3e62 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -946,9 +946,9 @@ static void soc_remove_dai(struct snd_soc_dai *dai, int order) { int err; - if (dai && dai->probed && - dai->driver->remove_order == order) { - if (dai->driver->remove) { + if (dai && dai->probed) { + if (dai->driver && dai->driver->remove_order == order && + dai->driver->remove) { err = dai->driver->remove(dai); if (err < 0) dev_err(dai->dev, diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c index 00ab616f1bfc67..fa72c892e461a1 100644 --- a/sound/soc/soc-topology.c +++ b/sound/soc/soc-topology.c @@ -508,6 +508,7 @@ static void remove_dai(struct snd_soc_component *comp, { struct snd_soc_dai_driver *dai_drv = container_of(dobj, struct snd_soc_dai_driver, dobj); + struct snd_soc_dai *dai; if (pass != SOC_TPLG_PASS_PCM_DAI) return; @@ -515,6 +516,10 @@ static void remove_dai(struct snd_soc_component *comp, if (dobj->ops && dobj->ops->dai_unload) dobj->ops->dai_unload(comp, dobj); + list_for_each_entry(dai, &comp->dai_list, list) + if (dai->driver == dai_drv) + dai->driver = NULL; + kfree(dai_drv->name); list_del(&dobj->list); kfree(dai_drv);