lkml.org 
[lkml]   [2019]   [Jul]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.2 230/249] ASoC: audio-graph-card: fix use-after-free in graph_for_each_link
    Date
    From: Wen Yang <wen.yang99@zte.com.cn>

    [ Upstream commit 1bcc1fd64e4dd903f4d868a9e053986e3b102713 ]

    After calling of_node_put() on the codec_ep and codec_port variables,
    they are still being used, which may result in use-after-free.
    We fix this issue by calling of_node_put() after the last usage.

    Fixes: fce9b90c1ab7 ("ASoC: audio-graph-card: cleanup DAI link loop method - step2")
    Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
    Cc: Liam Girdwood <lgirdwood@gmail.com>
    Cc: Mark Brown <broonie@kernel.org>
    Cc: Jaroslav Kysela <perex@perex.cz>
    Cc: Takashi Iwai <tiwai@suse.com>
    Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
    Cc: alsa-devel@alsa-project.org
    Cc: linux-kernel@vger.kernel.org
    Link: https://lore.kernel.org/r/1562229530-8121-1-git-send-email-wen.yang99@zte.com.cn
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    sound/soc/generic/audio-graph-card.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
    index ec7e673ba475..70ed28d97d49 100644
    --- a/sound/soc/generic/audio-graph-card.c
    +++ b/sound/soc/generic/audio-graph-card.c
    @@ -435,9 +435,6 @@ static int graph_for_each_link(struct asoc_simple_priv *priv,
    codec_ep = of_graph_get_remote_endpoint(cpu_ep);
    codec_port = of_get_parent(codec_ep);

    - of_node_put(codec_ep);
    - of_node_put(codec_port);
    -
    /* get convert-xxx property */
    memset(&adata, 0, sizeof(adata));
    graph_parse_convert(dev, codec_ep, &adata);
    @@ -457,6 +454,9 @@ static int graph_for_each_link(struct asoc_simple_priv *priv,
    else
    ret = func_noml(priv, cpu_ep, codec_ep, li);

    + of_node_put(codec_ep);
    + of_node_put(codec_port);
    +
    if (ret < 0)
    return ret;

    --
    2.20.1
    \
     
     \ /
      Last update: 2019-07-15 16:15    [W:3.917 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site