diff options
| author |   Xiaomeng Tong <xiam0nd.tong@gmail.com> | 2022-03-29 09:21:34 +0800 |
|---|---|---|
| committer |   Mark Brown <broonie@kernel.org> | 2022-04-05 10:24:44 +0100 |
| commit | f730a46b931d894816af34a0ff8e4ad51565b39f (patch) | |
| tree | 3698abbb440c675bb3abe454b33087b9bed5a4d9 /sound/soc/soc-dapm.c | |
| parent | ASoC: soc-pcm: use GFP_KERNEL when the code is sleepable (diff) | |
| download | linux-dev-f730a46b931d894816af34a0ff8e4ad51565b39f.tar.xz linux-dev-f730a46b931d894816af34a0ff8e4ad51565b39f.zip | |
ASoC: soc-dapm: fix two incorrect uses of list iterator
These two bug are here:
list_for_each_entry_safe_continue(w, n, list,
power_list);
list_for_each_entry_safe_continue(w, n, list,
power_list);
After the list_for_each_entry_safe_continue() exits, the list iterator
will always be a bogus pointer which point to an invalid struct objdect
containing HEAD member. The funciton poniter 'w->event' will be a
invalid value which can lead to a control-flow hijack if the 'w' can be
controlled.
The original intention was to continue the outer list_for_each_entry_safe()
loop with the same entry if w->event is NULL, but misunderstanding the
meaning of list_for_each_entry_safe_continue().
So just add a 'continue;' to fix the bug.
Cc: stable@vger.kernel.org
Fixes: 163cac061c973 ("ASoC: Factor out DAPM sequence execution")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Link: https://lore.kernel.org/r/20220329012134.9375-1-xiam0nd.tong@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound/soc/soc-dapm.c')
| -rw-r--r-- | sound/soc/soc-dapm.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index b435b5c4cfb7..ca917a849c42 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -1687,8 +1687,7 @@ static void dapm_seq_run(struct snd_soc_card *card, switch (w->id) { case snd_soc_dapm_pre: if (!w->event) - list_for_each_entry_safe_continue(w, n, list, - power_list); + continue; if (event == SND_SOC_DAPM_STREAM_START) ret = w->event(w, @@ -1700,8 +1699,7 @@ static void dapm_seq_run(struct snd_soc_card *card, case snd_soc_dapm_post: if (!w->event) - list_for_each_entry_safe_continue(w, n, list, - power_list); + continue; if (event == SND_SOC_DAPM_STREAM_START) ret = w->event(w, |