From: Guennadi Liakhovetski guennadi.liakhovetski@intel.com
rmmod/modprobe tests expose a kernel oops when accessing the dai driver pointer. This comes from the topology design which operates in multiple passes. Each object removal happens at a specific iteration, and the code checks for the iteration (order) number after the memory containing the order was freed.
Fix this be clearing a reference to the dai driver and check its validity to avoid dereferences.
Signed-off-by: Guennadi Liakhovetski guennadi.liakhovetski@intel.com Signed-off-by: Pierre-Louis Bossart pierre-louis.bossart@linux.intel.com --- sound/soc/soc-core.c | 2 +- sound/soc/soc-topology.c | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index d6b5edba8d2d..9dad2b1498c1 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -965,7 +965,7 @@ static void soc_remove_dai(struct snd_soc_dai *dai, int order) { int err;
- if (!dai || !dai->probed || + if (!dai || !dai->probed || !dai->driver || dai->driver->remove_order != order) return;
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c index 23d421370e6c..bb7e5422a419 100644 --- a/sound/soc/soc-topology.c +++ b/sound/soc/soc-topology.c @@ -523,6 +523,7 @@ static void remove_dai(struct snd_soc_component *comp, { struct snd_soc_dai_driver *dai_drv = container_of(dobj, struct snd_soc_dai_driver, dobj); + struct snd_soc_dai *dai;
if (pass != SOC_TPLG_PASS_PCM_DAI) return; @@ -530,6 +531,10 @@ static void remove_dai(struct snd_soc_component *comp, if (dobj->ops && dobj->ops->dai_unload) dobj->ops->dai_unload(comp, dobj);
+ list_for_each_entry(dai, &comp->dai_list, list) + if (dai->driver == dai_drv) + dai->driver = NULL; + kfree(dai_drv->name); list_del(&dobj->list); kfree(dai_drv);