From patchwork Mon Jun 4 11:13:26 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Srinivas Kandagatla X-Patchwork-Id: 10446337 X-Patchwork-Delegate: agross@codeaurora.org Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id ADF5F603D7 for ; Mon, 4 Jun 2018 11:15:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9441526E74 for ; Mon, 4 Jun 2018 11:15:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 866AE28C19; Mon, 4 Jun 2018 11:15:37 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1A93F26E74 for ; Mon, 4 Jun 2018 11:15:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752261AbeFDLPg (ORCPT ); Mon, 4 Jun 2018 07:15:36 -0400 Received: from mail-wm0-f67.google.com ([74.125.82.67]:52809 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752179AbeFDLPf (ORCPT ); Mon, 4 Jun 2018 07:15:35 -0400 Received: by mail-wm0-f67.google.com with SMTP id p126-v6so5824135wmb.2 for ; Mon, 04 Jun 2018 04:15:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=WWwRbplkCIj6tECE6ciACyoqRu0p9rYIlE8uf1QFvSA=; b=fmYltAxO5TAHTaI17aDtiAKo4Qk3MhaXoVB30tcQHticHagygKmAkqill70KZqsnbF bbFHrUhs92BmzLc2cfN3CyetX6nGjkFxINsNUu1pfrM+bFMXVK72tjsUiEbnlIOoRopS 6bcB5uKtKagPrqqxrk0r7BsPY+OspiUv3xbRU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=WWwRbplkCIj6tECE6ciACyoqRu0p9rYIlE8uf1QFvSA=; b=f2S/5ASGjqWtU9g9RQoSv7gUydd26uqp0TiPn+FXHZ9Ot1m8yiSH3vpfONV3SoLxBE YvoILD1nSC2nsMo5PtAhzI+k3l7XmnBvRm0T2BnfuUCz8CO5f+oqdoXS0RL/s92UzC2I W1O0rhldg44IJv7UnBVfG2X8aurBlXBeQBYV/fL3rkwLdEjTrApsQ4YrPD2I0Tl+B3xV wLDvsq6D/FOxq5MeMKPQ+Sl7a5Q+7AKg2lCGSjzRMR2FbvdqbE4ZKcF9d0A8fHe1DgDq AWQZ+VIj2GzXQPZcWs1IM/SFGkrRoGsgKWEs5BEGdU5ddZPjwQfpJXCb5H1V28UzIMwx JDDw== X-Gm-Message-State: ALKqPwfTbbdSFBSyF04INIKDL0ZYh6HkptHl3cxhI6S0CKan/UuJKPD/ 0UYs/dy1Xa05oEtHZlVDrajY4Q== X-Google-Smtp-Source: ADUXVKIv1ziHWp8b+zLXqzMFMWB5eiCe9/9lXZcP3j60E4nKA2CzWjRePo37O9AoaYuRRYGoJva1JA== X-Received: by 2002:a1c:6fce:: with SMTP id c75-v6mr8532811wmi.83.1528110934161; Mon, 04 Jun 2018 04:15:34 -0700 (PDT) Received: from localhost.localdomain (cpc90716-aztw32-2-0-cust92.18-1.cable.virginm.net. [86.26.100.93]) by smtp.gmail.com with ESMTPSA id b204-v6sm8534478wmh.22.2018.06.04.04.15.32 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 04 Jun 2018 04:15:33 -0700 (PDT) From: Srinivas Kandagatla To: broonie@kernel.org, alsa-devel@alsa-project.org Cc: linux-arm-msm@vger.kernel.org, lgirdwood@gmail.com, bgoswami@codeaurora.org, tiwai@suse.com, perex@perex.cz, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, rohkumar@qti.qualcomm.com, Srinivas Kandagatla Subject: [PATCH v2] ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it Date: Mon, 4 Jun 2018 12:13:26 +0100 Message-Id: <20180604111326.15708-1-srinivas.kandagatla@linaro.org> X-Mailer: git-send-email 2.16.2 Sender: linux-arm-msm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP dapm_kcontrol_data is freed as part of dapm_kcontrol_free(), leaving the paths pointer dangling in the list. This leads to system crash when we try to unload and reload sound card. I hit this bug during ADSP crash/reboot test case on Dragon board DB410c. Without this patch, on SLAB Poisoning enabled build, kernel crashes with "BUG kmalloc-128 (Tainted: G W ): Poison overwritten" Signed-off-by: Srinivas Kandagatla --- Changes since v1: -remove unnecessary very long bug trace. sound/soc/soc-dapm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index 1e9a36389667..36a39ba30226 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -433,6 +433,8 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget, static void dapm_kcontrol_free(struct snd_kcontrol *kctl) { struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl); + + list_del(&data->paths); kfree(data->wlist); kfree(data); }