ASoC: topology: fix oops/use-after-free case with dai driver

Browse source

rmmod/modprobe tests expose a kernel oops when accessing the dai
driver pointer. This comes from the topology design which operates in
multiple passes. Each object removal happens at a specific iteration,
and the code checks for the iteration (order) number after the memory
containing the order was freed.

Fix this be clearing a reference to the dai driver and check its
validity to avoid dereferences.

Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>

...

This commit is contained in:

Guennadi Liakhovetski 2019-02-01 11:05:13 -06:00 • committed by Mark Brown

parent 7aea8a9d71

commit 52abe6cc18

No known key found for this signature in database

GPG key ID: 24D68B725D5487D0

2 changed files with 6 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

sound/soc/soc-core.c

View file

5

sound/soc/soc-topology.c

View file