From 550b349af0f0e33fedb252aca8dc144299aca308 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 14 Apr 2017 22:11:20 +0300
Subject: [PATCH] ASoC: Intel: Skylake: Fix a couple user after free bugs
We need to use the _safe() version of list_for_each_entry() here because
of the kfree(modules).
Fixes: b8c722ddd548 ("ASoC: Intel: Skylake: Add support for deferred DSP module bind")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
sound/soc/intel/skylake/skl-pcm.c | 4 ++--
sound/soc/intel/skylake/skl-topology.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index 600faad19bd4f..d43d1976dd3ba 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -1323,10 +1323,10 @@ int skl_platform_unregister(struct device *dev)
{
struct hdac_ext_bus *ebus = dev_get_drvdata(dev);
struct skl *skl = ebus_to_skl(ebus);
- struct skl_module_deferred_bind *modules;
+ struct skl_module_deferred_bind *modules, *tmp;
if (!list_empty(&skl->bind_list)) {
- list_for_each_entry(modules, &skl->bind_list, node) {
+ list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) {
list_del(&modules->node);
kfree(modules);
}
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index 7f285176a0744..0e459d3eb17ab 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -1091,7 +1091,7 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
struct skl_module_cfg *src_module = NULL, *dst_module;
struct skl_sst *ctx = skl->skl_sst;
struct skl_pipe *s_pipe = mconfig->pipe;
- struct skl_module_deferred_bind *modules;
+ struct skl_module_deferred_bind *modules, *tmp;
if (s_pipe->state == SKL_PIPE_INVALID)
return -EINVAL;
@@ -1105,7 +1105,7 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
src_module = w_module->w->priv;
- list_for_each_entry(modules, &skl->bind_list, node) {
+ list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) {
/*
* When the destination module is deleted, Unbind the
* modules from deferred bind list.
--
2.30.2