AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-11-24 16:30:52 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

ASoC: topology: fix oops/use-after-free case with dai driver

Browse Source 
rmmod/modprobe tests expose a kernel oops when accessing the dai
driver pointer. This comes from the topology design which operates in
multiple passes. Each object removal happens at a specific iteration,
and the code checks for the iteration (order) number after the memory
containing the order was freed.

Fix this be clearing a reference to the dai driver and check its
validity to avoid dereferences.

Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Guennadi Liakhovetski 2019-02-01 11:05:13 -06:00 committed by Mark Brown
parent 7aea8a9d71
commit 52abe6cc18
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sound/soc/soc-core.c
View File

@ -956,7 +956,7 @@ static void soc_remove_dai(struct snd_soc_dai *dai, int order)
{ {
int err; int err;
if (!dai || !dai->probed || if (!dai || !dai->probed || !dai->driver ||
dai->driver->remove_order != order) dai->driver->remove_order != order)
return; return;

5
sound/soc/soc-topology.c
View File

@ -502,6 +502,7 @@ static void remove_dai(struct snd_soc_component *comp,
{ {
struct snd_soc_dai_driver *dai_drv = struct snd_soc_dai_driver *dai_drv =
container_of(dobj, struct snd_soc_dai_driver, dobj); container_of(dobj, struct snd_soc_dai_driver, dobj);
struct snd_soc_dai *dai;
if (pass != SOC_TPLG_PASS_PCM_DAI) if (pass != SOC_TPLG_PASS_PCM_DAI)
return; return;
@ -509,6 +510,10 @@ static void remove_dai(struct snd_soc_component *comp,
if (dobj->ops && dobj->ops->dai_unload) if (dobj->ops && dobj->ops->dai_unload)
dobj->ops->dai_unload(comp, dobj); dobj->ops->dai_unload(comp, dobj);
list_for_each_entry(dai, &comp->dai_list, list)
if (dai->driver == dai_drv)
dai->driver = NULL;
kfree(dai_drv->name); kfree(dai_drv->name);
list_del(&dobj->list); list_del(&dobj->list);
kfree(dai_drv); kfree(dai_drv);