[ Upstream commit 2abee12c0ab1924a69993d2c063a39a952e7d836 ]
The cpu_dai variable is still being used after the of_node_put() call, which may result in double-free:
of_node_put(cpu_dai); ---> released here
ret = devm_snd_soc_register_card(dev, card); if (ret < 0) { ... goto err_put_clk_i2s; --> jump to err_put_clk_i2s ...
err_put_clk_i2s: clk_put(priv->clk_i2s_bus); err_put_sclk: clk_put(priv->sclk_i2s); err_put_cpu_dai: of_node_put(cpu_dai); --> double-free here
Fixes: d832d2b246c5 ("ASoC: samsung: odroid: Fix of_node refcount unbalance") Signed-off-by: Wen Yang wen.yang99@zte.com.cn Cc: Krzysztof Kozlowski krzk@kernel.org Cc: Sangbeom Kim sbkim73@samsung.com Cc: Sylwester Nawrocki s.nawrocki@samsung.com Cc: Liam Girdwood lgirdwood@gmail.com Cc: Mark Brown broonie@kernel.org Cc: Jaroslav Kysela perex@perex.cz Cc: Takashi Iwai tiwai@suse.com Cc: alsa-devel@alsa-project.org Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/1562989575-33785-3-git-send-email-wen.yang99@zte.c... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/samsung/odroid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c index 95c35e3ff3303..d606e48fe551a 100644 --- a/sound/soc/samsung/odroid.c +++ b/sound/soc/samsung/odroid.c @@ -299,7 +299,6 @@ static int odroid_audio_probe(struct platform_device *pdev) ret = PTR_ERR(priv->clk_i2s_bus); goto err_put_sclk; } - of_node_put(cpu_dai);
ret = devm_snd_soc_register_card(dev, card); if (ret < 0) { @@ -307,6 +306,7 @@ static int odroid_audio_probe(struct platform_device *pdev) goto err_put_clk_i2s; }
+ of_node_put(cpu_dai); of_node_put(codec); return 0;