diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2017-04-14 22:11:20 +0300 |
|---|---|---|
| committer |   Mark Brown <broonie@kernel.org> | 2017-04-21 18:00:33 +0100 |
| commit | 550b349af0f0e33fedb252aca8dc144299aca308 (patch) | |
| tree | 0ec67c4d491d0a5cc30f185559e5a506cb2574de /sound | |
| parent | ASoC: Intel: Skylake: Uninitialized variable in probe_codec() (diff) | |
| download | linux-dev-550b349af0f0e33fedb252aca8dc144299aca308.tar.xz linux-dev-550b349af0f0e33fedb252aca8dc144299aca308.zip | |
ASoC: Intel: Skylake: Fix a couple user after free bugs
We need to use the _safe() version of list_for_each_entry() here because
of the kfree(modules).
Fixes: b8c722ddd548 ("ASoC: Intel: Skylake: Add support for deferred DSP module bind")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/intel/skylake/skl-pcm.c | 4 | ||||
| -rw-r--r-- | sound/soc/intel/skylake/skl-topology.c | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c index 600faad19bd4..d43d1976dd3b 100644 --- a/sound/soc/intel/skylake/skl-pcm.c +++ b/sound/soc/intel/skylake/skl-pcm.c @@ -1323,10 +1323,10 @@ int skl_platform_unregister(struct device *dev) { struct hdac_ext_bus *ebus = dev_get_drvdata(dev); struct skl *skl = ebus_to_skl(ebus); - struct skl_module_deferred_bind *modules; + struct skl_module_deferred_bind *modules, *tmp; if (!list_empty(&skl->bind_list)) { - list_for_each_entry(modules, &skl->bind_list, node) { + list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) { list_del(&modules->node); kfree(modules); } diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c index 7f285176a074..0e459d3eb17a 100644 --- a/sound/soc/intel/skylake/skl-topology.c +++ b/sound/soc/intel/skylake/skl-topology.c @@ -1091,7 +1091,7 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w, struct skl_module_cfg *src_module = NULL, *dst_module; struct skl_sst *ctx = skl->skl_sst; struct skl_pipe *s_pipe = mconfig->pipe; - struct skl_module_deferred_bind *modules; + struct skl_module_deferred_bind *modules, *tmp; if (s_pipe->state == SKL_PIPE_INVALID) return -EINVAL; @@ -1105,7 +1105,7 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w, src_module = w_module->w->priv; - list_for_each_entry(modules, &skl->bind_list, node) { + list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) { /* * When the destination module is deleted, Unbind the * modules from deferred bind list. |