Merge "ASoC: Fix freed memory access of pcm stream kctl" (359db4da) · Commits · e / devices / android_kernel_sony_msm8998

sound/core/control.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -160,6 +160,8 @@ void snd_ctl_notify(struct snd_card *card, unsigned int mask,

		if (snd_BUG_ON(!card \|\| !id))
		return;
		if (card->shutdown)
		return;
		read_lock(&card->ctl_files_rwlock);
		#if IS_ENABLED(CONFIG_SND_MIXER_OSS)
		card->mixer_oss_change_count++;

+18 −12

Original line number	Diff line number	Diff line
		@@ -849,6 +849,22 @@ int snd_pcm_new_internal(struct snd_card card, const char id, int device,
		}
		EXPORT_SYMBOL(snd_pcm_new_internal);

		static void free_pcm_kctl(struct snd_pcm_str *pstr)
		{
		if (pstr->chmap_kctl) {
		snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl);
		pstr->chmap_kctl = NULL;
		}
		if (pstr->vol_kctl) {
		snd_ctl_remove(pstr->pcm->card, pstr->vol_kctl);
		pstr->vol_kctl = NULL;
		}
		if (pstr->usr_kctl) {
		snd_ctl_remove(pstr->pcm->card, pstr->usr_kctl);
		pstr->usr_kctl = NULL;
		}
		}

		static void snd_pcm_free_stream(struct snd_pcm_str * pstr)
		{
		struct snd_pcm_substream substream, substream_next;
		@@ -871,6 +887,7 @@ static void snd_pcm_free_stream(struct snd_pcm_str * pstr)
		kfree(setup);
		}
		#endif
		free_pcm_kctl(pstr);
		if (pstr->substream_count)
		put_device(&pstr->dev);
		}
		@@ -1135,18 +1152,7 @@ static int snd_pcm_dev_disconnect(struct snd_device *device)
		for (cidx = 0; cidx < 2; cidx++) {
		if (!pcm->internal)
		snd_unregister_device(&pcm->streams[cidx].dev);
		if (pcm->streams[cidx].chmap_kctl) {
		snd_ctl_remove(pcm->card, pcm->streams[cidx].chmap_kctl);
		pcm->streams[cidx].chmap_kctl = NULL;
		}
		if (pcm->streams[cidx].vol_kctl) {
		snd_ctl_remove(pcm->card, pcm->streams[cidx].vol_kctl);
		pcm->streams[cidx].vol_kctl = NULL;
		}
		if (pcm->streams[cidx].usr_kctl) {
		snd_ctl_remove(pcm->card, pcm->streams[cidx].usr_kctl);
		pcm->streams[cidx].usr_kctl = NULL;
		}
		free_pcm_kctl(&pcm->streams[cidx]);
		}
		mutex_unlock(&pcm->open_mutex);
		mutex_unlock(&register_mutex);