On 2/11/24 09:09, Daniil Dulov wrote:
If sdw_ml_sync_bank_switch() returns error not on the first iteration, it leads to freeing prevously freed memory. So, set the pointer to NULL after each successful bank switch.
Signed-off-by: Daniil Dulov d.dulov@aladdin.ru
drivers/soundwire/stream.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c index 304ff2ee7d75..d650e6f0f8e7 100644 --- a/drivers/soundwire/stream.c +++ b/drivers/soundwire/stream.c @@ -833,6 +833,7 @@ static int do_bank_switch(struct sdw_stream_runtime *stream) "multi link bank switch failed: %d\n", ret); goto error; }
bus->defer_msg.msg = NULL;if (multi_link) mutex_unlock(&bus->msg_lock);
Not following what the issue is...
On success, sdw_ml_sync_bank_switch() frees the buffers with
if (bus->defer_msg.msg) { kfree(bus->defer_msg.msg->buf); kfree(bus->defer_msg.msg); bus->defer_msg.msg = NULL; }
So if there is an issue on the second iteration, then the loop will detect already freed memory in the previous iteration and skip it:
/* Check if bank switch was successful */ ret = sdw_ml_sync_bank_switch(bus); if (ret < 0) { dev_err(bus->dev, "multi link bank switch failed: %d\n", ret); goto error; }
error: list_for_each_entry(m_rt, &stream->master_list, stream_node) { bus = m_rt->bus; if (bus->defer_msg.msg) { <<<< TEST FOR FREED MEMORY kfree(bus->defer_msg.msg->buf); kfree(bus->defer_msg.msg); bus->defer_msg.msg = NULL; } }
It could very well be that I need more coffee on this post-SuperBowl Monday morning, but I just don't see the problem.