soundwire: fix double free of dangling pointer
[ Upstream commit3fbbf2148a
] clang static analysis flags this problem stream.c:844:9: warning: Use of memory after it is freed kfree(bus->defer_msg.msg->buf); ^~~~~~~~~~~~~~~~~~~~~~~ This happens in an error handler cleaning up memory allocated for elements in a list. list_for_each_entry(m_rt, &stream->master_list, stream_node) { bus = m_rt->bus; kfree(bus->defer_msg.msg->buf); kfree(bus->defer_msg.msg); } And is triggered when the call to sdw_bank_switch() fails. There are a two problems. First, when sdw_bank_switch() fails, though it frees memory it does not clear bus's reference 'defer_msg.msg' to that memory. The second problem is the freeing msg->buf. In some cases msg will be NULL so this will dereference a null pointer. Need to check before freeing. Fixes:99b8a5d608
("soundwire: Add bank switch routine") Signed-off-by: Tom Rix <trix@redhat.com> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Link: https://lore.kernel.org/r/20200902202650.14189-1-trix@redhat.com Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
122cdbd501
commit
fe0278843b
|
@ -702,6 +702,7 @@ error:
|
||||||
kfree(wbuf);
|
kfree(wbuf);
|
||||||
error_1:
|
error_1:
|
||||||
kfree(wr_msg);
|
kfree(wr_msg);
|
||||||
|
bus->defer_msg.msg = NULL;
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -825,9 +826,10 @@ static int do_bank_switch(struct sdw_stream_runtime *stream)
|
||||||
error:
|
error:
|
||||||
list_for_each_entry(m_rt, &stream->master_list, stream_node) {
|
list_for_each_entry(m_rt, &stream->master_list, stream_node) {
|
||||||
bus = m_rt->bus;
|
bus = m_rt->bus;
|
||||||
|
if (bus->defer_msg.msg) {
|
||||||
kfree(bus->defer_msg.msg->buf);
|
kfree(bus->defer_msg.msg->buf);
|
||||||
kfree(bus->defer_msg.msg);
|
kfree(bus->defer_msg.msg);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
msg_unlock:
|
msg_unlock:
|
||||||
|
|
Loading…
Reference in New Issue