evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ASoC: Fix use after free

Browse source 
Freeing the current list element while iterating over the list will cause a use
after free since the iterator function will still use the current element to
look up the next. Use list_for_each_safe() and remove the element from the list
before freeing it to avoid this.

Fixes: 1438c2f60b ("ASoC: Add a per component dai list")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
This commit is contained in:
Lars-Peter Clausen 2014-03-12 08:34:39 +01:00 • committed by Mark Brown
parent 1438c2f60b
commit 5c1d5f091d
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
sound/soc/soc-core.c
View file

@ -3913,11 +3913,12 @@ static inline char *fmt_multiple_name(struct device *dev,
*/ */
static void snd_soc_unregister_dais(struct snd_soc_component *component) static void snd_soc_unregister_dais(struct snd_soc_component *component)
{ {
struct snd_soc_dai *dai; struct snd_soc_dai *dai, *_dai;
list_for_each_entry(dai, &component->dai_list, list) { list_for_each_entry_safe(dai, _dai, &component->dai_list, list) {
dev_dbg(component->dev, "ASoC: Unregistered DAI '%s'\n", dev_dbg(component->dev, "ASoC: Unregistered DAI '%s'\n",
dai->name); dai->name);
list_del(&dai->list);
kfree(dai->name); kfree(dai->name);
kfree(dai); kfree(dai);
} }