| Message ID | 20241217100707.732766-1-perex@perex.cz (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | ALSA: compress_offload: use safe list iteration in snd_compr_task_seq() | expand |
On Tue, 17 Dec 2024 11:07:07 +0100, Jaroslav Kysela wrote: > > The sequence function can call snd_compr_task_free_one(). Use > list_for_each_entry_safe_reverse() to make sure that the used > pointers are safe. > > Link: https://lore.kernel.org/linux-sound/f2769cff-6c7a-4092-a2d1-c33a5411a182@stanley.mountain/ > Fixes: 04177158cf98 ("ALSA: compress_offload: introduce accel operation mode") > Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > Cc: Vinod Koul <vkoul@kernel.org> > Signed-off-by: Jaroslav Kysela <perex@perex.cz> Applied now. Thanks. Takashi
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c index 86ed2fbee0c8..ed69b742786c 100644 --- a/sound/core/compress_offload.c +++ b/sound/core/compress_offload.c @@ -1174,7 +1174,7 @@ typedef void (*snd_compr_seq_func_t)(struct snd_compr_stream *stream, static int snd_compr_task_seq(struct snd_compr_stream *stream, unsigned long arg, snd_compr_seq_func_t fcn) { - struct snd_compr_task_runtime *task; + struct snd_compr_task_runtime *task, *temp; __u64 seqno; int retval; @@ -1185,7 +1185,7 @@ static int snd_compr_task_seq(struct snd_compr_stream *stream, unsigned long arg return retval; retval = 0; if (seqno == 0) { - list_for_each_entry_reverse(task, &stream->runtime->tasks, list) + list_for_each_entry_safe_reverse(task, temp, &stream->runtime->tasks, list) fcn(stream, task); } else { task = snd_compr_find_task(stream, seqno);
The sequence function can call snd_compr_task_free_one(). Use list_for_each_entry_safe_reverse() to make sure that the used pointers are safe. Link: https://lore.kernel.org/linux-sound/f2769cff-6c7a-4092-a2d1-c33a5411a182@stanley.mountain/ Fixes: 04177158cf98 ("ALSA: compress_offload: introduce accel operation mode") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Cc: Vinod Koul <vkoul@kernel.org> Signed-off-by: Jaroslav Kysela <perex@perex.cz> --- sound/core/compress_offload.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)