lkml.org 
[lkml]   [2019]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.2 002/123] ASoC: simple-card: fix an use-after-free in simple_dai_link_of_dpcm()
    Date
    From: Wen Yang <wen.yang99@zte.com.cn>

    [ Upstream commit 724808ad556c15e9473418d082f8aae81dd267f6 ]

    The node variable is still being used after the of_node_put() call,
    which may result in use-after-free.

    Fixes: cfc652a73331 ("ASoC: simple-card: tidyup prefix for snd_soc_codec_conf")
    Link: https://lore.kernel.org/r/1562743509-30496-2-git-send-email-wen.yang99@zte.com.cn
    Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
    Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    sound/soc/generic/simple-card.c | 22 +++++++++++-----------
    1 file changed, 11 insertions(+), 11 deletions(-)

    diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
    index 9b568f578bcd2..544064fdc780c 100644
    --- a/sound/soc/generic/simple-card.c
    +++ b/sound/soc/generic/simple-card.c
    @@ -138,8 +138,6 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,

    li->link++;

    - of_node_put(node);
    -
    /* For single DAI link & old style of DT node */
    if (is_top)
    prefix = PREFIX;
    @@ -161,17 +159,17 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,

    ret = asoc_simple_parse_cpu(np, dai_link, &is_single_links);
    if (ret)
    - return ret;
    + goto out_put_node;

    ret = asoc_simple_parse_clk_cpu(dev, np, dai_link, dai);
    if (ret < 0)
    - return ret;
    + goto out_put_node;

    ret = asoc_simple_set_dailink_name(dev, dai_link,
    "fe.%s",
    dai_link->cpu_dai_name);
    if (ret < 0)
    - return ret;
    + goto out_put_node;

    asoc_simple_canonicalize_cpu(dai_link, is_single_links);
    } else {
    @@ -194,17 +192,17 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,

    ret = asoc_simple_parse_codec(np, dai_link);
    if (ret < 0)
    - return ret;
    + goto out_put_node;

    ret = asoc_simple_parse_clk_codec(dev, np, dai_link, dai);
    if (ret < 0)
    - return ret;
    + goto out_put_node;

    ret = asoc_simple_set_dailink_name(dev, dai_link,
    "be.%s",
    codecs->dai_name);
    if (ret < 0)
    - return ret;
    + goto out_put_node;

    /* check "prefix" from top node */
    snd_soc_of_parse_node_prefix(top, cconf, codecs->of_node,
    @@ -222,19 +220,21 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,

    ret = asoc_simple_parse_tdm(np, dai);
    if (ret)
    - return ret;
    + goto out_put_node;

    ret = asoc_simple_parse_daifmt(dev, node, codec,
    prefix, &dai_link->dai_fmt);
    if (ret < 0)
    - return ret;
    + goto out_put_node;

    dai_link->dpcm_playback = 1;
    dai_link->dpcm_capture = 1;
    dai_link->ops = &simple_ops;
    dai_link->init = asoc_simple_dai_init;

    - return 0;
    +out_put_node:
    + of_node_put(node);
    + return ret;
    }

    static int simple_dai_link_of(struct asoc_simple_priv *priv,
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-08-14 04:41    [W:4.123 / U:0.208 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site