Remove the DAPM debugfs entries before freeing the context's widgets, otherwise a use after free situation might occur.
Signed-off-by: Lars-Peter Clausen lars@metafoo.de --- sound/soc/soc-dapm.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index 8454cc2..169e176 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -1292,6 +1292,11 @@ static void dapm_debugfs_add_widget(struct snd_soc_dapm_widget *w) w->name); }
+static void dapm_debugfs_cleanup(struct snd_soc_dapm_context *dapm) +{ + debugfs_remove_recursive(dapm->debugfs_dapm); +} + #else void snd_soc_dapm_debugfs_init(struct snd_soc_dapm_context *dapm, struct dentry *parent) @@ -1302,6 +1307,10 @@ static inline void dapm_debugfs_add_widget(struct snd_soc_dapm_widget *w) { }
+static inline void dapm_debugfs_cleanup(struct snd_soc_dapm_context *dapm) +{ +} + #endif
/* test and update the power status of a mux widget */ @@ -2445,6 +2454,7 @@ EXPORT_SYMBOL_GPL(snd_soc_dapm_ignore_suspend); void snd_soc_dapm_free(struct snd_soc_dapm_context *dapm) { snd_soc_dapm_sys_remove(dapm->dev); + dapm_debugfs_cleanup(dapm); dapm_free_widgets(dapm); list_del(&dapm->list); }