Commit 5c1d5f09 authored Mar 12, 2014 by Lars-Peter Clausen Committed by Mark Brown Mar 12, 2014

ASoC: Fix use after free



Freeing the current list element while iterating over the list will cause a use
after free since the iterator function will still use the current element to
look up the next. Use list_for_each_safe() and remove the element from the list
before freeing it to avoid this.

Fixes: 1438c2f6 ("ASoC: Add a per component dai list")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>

parent 1438c2f6

sound/soc/soc-core.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -3913,11 +3913,12 @@ static inline char fmt_multiple_name(struct device dev,
		*/
		static void snd_soc_unregister_dais(struct snd_soc_component *component)
		{
		struct snd_soc_dai *dai;
		struct snd_soc_dai dai, _dai;

		list_for_each_entry(dai, &component->dai_list, list) {
		list_for_each_entry_safe(dai, _dai, &component->dai_list, list) {
		dev_dbg(component->dev, "ASoC: Unregistered DAI '%s'\n",
		dai->name);
		list_del(&dai->list);
		kfree(dai->name);
		kfree(dai);
		}