ASoC: dapm: fix use-after-free issue with dailink sname

Browse source

Commit 7620fe9161 ("ASoC: topology: fix memory leak in
soc_tplg_dapm_widget_create") fixed a memory leak issue, but
additional tests and KASAN reports show a use-after-free in soc-dapm.

The widgets are created with a kmemdup operating on a template. The
"name" string is also duplicated, but the "sname" string is not. As a
result, when the template is freed after widget creation, its sname
string is still used.

Fix by explicitly duplicating the "sname" string, and freeing it when
required.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>

...

This commit is contained in:

Pierre-Louis Bossart 2019-02-01 11:05:12 -06:00 • committed by Mark Brown

parent 4bd8597dc3

commit 199ed3e81c

No known key found for this signature in database

GPG key ID: 24D68B725D5487D0

1 changed files with 18 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

19

sound/soc/soc-dapm.c

View file