summaryrefslogtreecommitdiffstats
path: root/sound/soc/soc-dapm.c
diff options
context:
space:
mode:
authorCharles Keepax <ckeepax@opensource.cirrus.com>2020-05-26 18:19:30 +0200
committerMark Brown <broonie@kernel.org>2020-05-27 14:24:13 +0200
commitf4aa5e214eeaf7f1c7f157526a5aa29784cb6a1f (patch)
treef2a3eaf814b830a9eb1da54143051b9173984076 /sound/soc/soc-dapm.c
parentASoC: max9867: fix ADC level control (diff)
downloadlinux-f4aa5e214eeaf7f1c7f157526a5aa29784cb6a1f.tar.xz
linux-f4aa5e214eeaf7f1c7f157526a5aa29784cb6a1f.zip
ASoC: dapm: Move dai_link widgets to runtime to fix use after free
The newly added CODEC to CODEC DAI link widget pointers in snd_soc_dai_link are better placed in snd_soc_pcm_runtime. snd_soc_dai_link is really intended for static configuration of the DAI, and the runtime for dynamic data. The snd_soc_dai_link structures are not destroyed if the card is unbound. The widgets are cleared up on unbind, however if the card is rebound as the snd_soc_dai_link structures are reused these pointers will be left at their old values, causing access to freed memory. Fixes: 595571cca4de ("ASoC: dapm: Fix regression introducing multiple copies of DAI widgets") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://lore.kernel.org/r/20200526161930.30759-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound/soc/soc-dapm.c')
-rw-r--r--sound/soc/soc-dapm.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index e2632841b321..c0aa64ff8e32 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -4340,16 +4340,16 @@ static void dapm_connect_dai_pair(struct snd_soc_card *card,
codec = codec_dai->playback_widget;
if (playback_cpu && codec) {
- if (dai_link->params && !dai_link->playback_widget) {
+ if (dai_link->params && !rtd->playback_widget) {
substream = streams[SNDRV_PCM_STREAM_PLAYBACK].substream;
dai = snd_soc_dapm_new_dai(card, substream, "playback");
if (IS_ERR(dai))
goto capture;
- dai_link->playback_widget = dai;
+ rtd->playback_widget = dai;
}
dapm_connect_dai_routes(&card->dapm, cpu_dai, playback_cpu,
- dai_link->playback_widget,
+ rtd->playback_widget,
codec_dai, codec);
}
@@ -4358,16 +4358,16 @@ capture:
codec = codec_dai->capture_widget;
if (codec && capture_cpu) {
- if (dai_link->params && !dai_link->capture_widget) {
+ if (dai_link->params && !rtd->capture_widget) {
substream = streams[SNDRV_PCM_STREAM_CAPTURE].substream;
dai = snd_soc_dapm_new_dai(card, substream, "capture");
if (IS_ERR(dai))
return;
- dai_link->capture_widget = dai;
+ rtd->capture_widget = dai;
}
dapm_connect_dai_routes(&card->dapm, codec_dai, codec,
- dai_link->capture_widget,
+ rtd->capture_widget,
cpu_dai, capture_cpu);
}
}