From patchwork Wed Mar 12 07:34:39 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lars-Peter Clausen X-Patchwork-Id: 3815781 Return-Path: X-Original-To: patchwork-alsa-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 6F681BF540 for ; Wed, 12 Mar 2014 07:34:23 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 6C8C12021F for ; Wed, 12 Mar 2014 07:34:22 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.kernel.org (Postfix) with ESMTP id 88648201F7 for ; Wed, 12 Mar 2014 07:34:21 +0000 (UTC) Received: by alsa0.perex.cz (Postfix, from userid 1000) id 7E32E2608E8; Wed, 12 Mar 2014 08:34:20 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from alsa0.perex.cz (localhost [IPv6:::1]) by alsa0.perex.cz (Postfix) with ESMTP id EA04F260857; Wed, 12 Mar 2014 08:34:15 +0100 (CET) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id 3C20A260890; Wed, 12 Mar 2014 08:34:14 +0100 (CET) Received: from smtp-out-106.synserver.de (smtp-out-168.synserver.de [212.40.185.168]) by alsa0.perex.cz (Postfix) with ESMTP id 167DD260859 for ; Wed, 12 Mar 2014 08:34:04 +0100 (CET) Received: (qmail 21795 invoked by uid 0); 12 Mar 2014 07:34:00 -0000 X-SynServer-TrustedSrc: 1 X-SynServer-AuthUser: lars@metafoo.de X-SynServer-PPID: 21661 Received: from ppp-46-244-130-51.dynamic.mnet-online.de (HELO lars-adi-laptop.fritz.box) [46.244.130.51] by 217.119.54.87 with SMTP; 12 Mar 2014 07:34:00 -0000 From: Lars-Peter Clausen To: Mark Brown , Liam Girdwood Date: Wed, 12 Mar 2014 08:34:39 +0100 Message-Id: <1394609679-10045-1-git-send-email-lars@metafoo.de> X-Mailer: git-send-email 1.8.0 Cc: alsa-devel@alsa-project.org, Lars-Peter Clausen , Dan Carpenter Subject: [alsa-devel] [PATCH] ASoC: Fix use after free X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP Freeing the current list element while iterating over the list will cause a use after free since the iterator function will still use the current element to look up the next. Use list_for_each_safe() and remove the element from the list before freeing it to avoid this. Fixes: 1438c2f60b ("ASoC: Add a per component dai list") Reported-by: Dan Carpenter Signed-off-by: Lars-Peter Clausen --- sound/soc/soc-core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index f67cef4..dac616d 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -3928,11 +3928,12 @@ static inline char *fmt_multiple_name(struct device *dev, */ static void snd_soc_unregister_dais(struct snd_soc_component *component) { - struct snd_soc_dai *dai; + struct snd_soc_dai *dai, *_dai; - list_for_each_entry(dai, &component->dai_list, list) { + list_for_each_entry_safe(dai, _dai, &component->dai_list, list) { dev_dbg(component->dev, "ASoC: Unregistered DAI '%s'\n", dai->name); + list_del(&dai->list); kfree(dai->name); kfree(dai); }